feat: rejected-cookie cache exclusions for WooCommerce cart

Add wp_recache_rejected_cookies option (defaults: woocommerce_items_in_cart,
wp_woocommerce_session_*, wp-postpass, comment_author_*, wordpress_*) that
bypasses page cache when any listed cookie is present. Both the WP-level
check (wp_recache_should_exclude) and the standalone drop-in apply the
same exact/prefix matching logic. Editing the option regenerates the
drop-in and purges all cache.

includes/Admin/Admin.php

@@ -22,6 +22,10 @@ class WP_Recache_Admin {
         add_action('admin_enqueue_scripts', 'wp_recache_enqueue_admin_bar_script');
         // New exclusions must not leave stale files that the drop-in would still serve.
         add_action('update_option_wp_recache_exclude_urls', 'wp_recache_delete_all_cache');
+        add_action('update_option_wp_recache_rejected_cookies', function () {
+            WP_Recache_Activator::create_cache_server();
+            wp_recache_delete_all_cache();
+        });
     }
 
     /**
@@ -59,6 +63,18 @@ class WP_Recache_Admin {
             'default' => ['/cart', '/checkout', '/my-account'],
         ]);
 
+        register_setting('wp_recache_settings', 'wp_recache_rejected_cookies', [
+            'type' => 'array',
+            'sanitize_callback' => [$this, 'sanitize_rejected_cookies'],
+            'default' => [
+                'woocommerce_items_in_cart',
+                'wp_woocommerce_session_*',
+                'wp-postpass',
+                'comment_author_*',
+                'wordpress_*',
+            ],
+        ]);
+
         register_setting('wp_recache_settings', 'wp_recache_minify_css', [
             'type' => 'boolean',
             'sanitize_callback' => 'rest_sanitize_boolean',
@@ -100,6 +116,22 @@ class WP_Recache_Admin {
         return array_map('sanitize_text_field', $lines);
     }
 
+    /**
+     * Sanitize rejected cookies.
+     *
+     * @param mixed $input Input value.
+     * @return array Sanitized cookie names.
+     */
+    public function sanitize_rejected_cookies($input) {
+        if (is_array($input)) {
+            $input = implode("\n", $input);
+        }
+
+        $lines = array_filter(array_map('trim', explode("\n", (string) $input)));
+
+        return array_map('sanitize_text_field', $lines);
+    }
+
     /**
      * Render settings page.
      */

includes/Admin/views/settings.php

@@ -52,6 +52,19 @@ $stats = WP_Recache_Admin::get_cache_stats();
                             <p class="description">One URL per line. These pages will not be cached.</p>
                         </td>
                     </tr>
+                    <tr>
+                        <th scope="row">Rejected Cookies</th>
+                        <td>
+                            <textarea name="wp_recache_rejected_cookies" rows="5" cols="50" class="large-text"><?php echo esc_textarea(implode("\n", get_option('wp_recache_rejected_cookies', [
+                                'woocommerce_items_in_cart',
+                                'wp_woocommerce_session_*',
+                                'wp-postpass',
+                                'comment_author_*',
+                                'wordpress_*',
+                            ]))); ?></textarea>
+                            <p class="description">One cookie name per line. Visitors with these cookies bypass the cache. Use <code>*</code> as a suffix to match a prefix (e.g. <code>comment_author_*</code>).</p>
+                        </td>
+                    </tr>
                 </table>
 
                 <h2>Cache Statistics</h2>