fix: address Phase 1 code review findings

- Serve cache via template_redirect so feeds/404/REST are excluded and
  query conditionals work
- Bypass cache on query strings; key files by md5(host+path) to avoid
  collisions and support multisite
- Write wp-content/wp-recache-cache.php drop-in server and set WP_CACHE
  in wp-config.php so advanced-cache.php actually runs
- Only remove advanced-cache.php on deactivation when it is ours
- Respect DONOTCACHEPAGE, non-200 responses; bots read but never warm
  cache
- Fix comment purge (comment_post_ID) and heartbeat purge ($data arg)
- Fix exclude URLs textarea parsing; purge all when exclusions change
- Enqueue admin purge script on every admin-bar page, not just settings
- Sync tests, add TESTING.md manual test guide

includes/Activator.php

@@ -15,7 +15,9 @@ class WP_Recache_Activator {
     public static function activate() {
         self::create_cache_directory();
         self::set_default_options();
+        self::create_cache_server();
         self::create_advanced_cache();
+        self::set_wp_cache_constant(true);
         self::flush_rewrite_rules();
     }
 
@@ -29,7 +31,7 @@ class WP_Recache_Activator {
 
         $htaccess = WP_RECACHE_CACHE_PATH . '.htaccess';
         if (!file_exists($htaccess)) {
-            file_put_contents($htaccess, "Deny from all\n");
+            file_put_contents($htaccess, "<IfModule mod_authz_core.c>\nRequire all denied\n</IfModule>\n<IfModule !mod_authz_core.c>\nDeny from all\n</IfModule>\n");
         }
 
         $index = WP_RECACHE_CACHE_PATH . 'index.php';
@@ -59,6 +61,50 @@ class WP_Recache_Activator {
         }
     }
 
+    /**
+     * Write the standalone cache server required by the advanced-cache.php
+     * drop-in. Must run without WordPress loaded.
+     */
+    private static function create_cache_server() {
+        $content = '<?php
+/**
+ * WP Recache early cache serving.
+ *
+ * This file is automatically generated by WP Recache.
+ * Do not edit this file manually.
+ */
+
+if (($_SERVER[\'REQUEST_METHOD\'] ?? \'GET\') !== \'GET\') {
+    return;
+}
+
+if (!empty($_SERVER[\'QUERY_STRING\'])) {
+    return;
+}
+
+foreach ($_COOKIE as $name => $value) {
+    if (strpos($name, \'wordpress_logged_in\') === 0) {
+        return;
+    }
+}
+
+$uri  = isset($_SERVER[\'REQUEST_URI\']) ? (string) parse_url($_SERVER[\'REQUEST_URI\'], PHP_URL_PATH) : \'/\';
+$host = $_SERVER[\'HTTP_HOST\'] ?? \'\';
+$file = WP_CONTENT_DIR . \'/cache/wp-recache/\' . md5($host . $uri) . \'.html\';
+
+// With separate mobile cache enabled, files carry a -desktop/-mobile suffix,
+// so the plain file never exists and serving falls through to WordPress.
+if (file_exists($file)) {
+    header(\'X-WP-Recache: HIT\');
+    header(\'X-WP-Recache-Dropin: 1\');
+    readfile($file);
+    exit;
+}
+';
+
+        file_put_contents(WP_CONTENT_DIR . '/wp-recache-cache.php', $content);
+    }
+
     /**
      * Create advanced-cache.php drop-in.
      */
@@ -87,6 +133,40 @@ if (file_exists(WP_CONTENT_DIR . \'/wp-recache-cache.php\')) {
         file_put_contents($advanced_cache, $content);
     }
 
+    /**
+     * Add or remove the WP_CACHE constant in wp-config.php.
+     *
+     * Without it, WordPress never loads advanced-cache.php.
+     *
+     * @param bool $enable True to add the constant, false to remove it.
+     */
+    public static function set_wp_cache_constant($enable) {
+        $marker = "define('WP_CACHE', true); // Added by WP Recache.\n";
+        $config_path = ABSPATH . 'wp-config.php';
+
+        if (!file_exists($config_path)) {
+            $config_path = dirname(ABSPATH) . '/wp-config.php';
+        }
+
+        if (!file_exists($config_path) || !is_writable($config_path)) {
+            return;
+        }
+
+        $content = file_get_contents($config_path);
+
+        if ($enable) {
+            if (strpos($content, $marker) !== false || preg_match("/define\s*\(\s*['\"]WP_CACHE['\"]\s*,\s*true\s*\)/", $content)) {
+                return;
+            }
+
+            $content = preg_replace('/^<\?php/', "<?php\n" . $marker, $content, 1);
+        } else {
+            $content = str_replace($marker, '', $content);
+        }
+
+        file_put_contents($config_path, $content);
+    }
+
     /**
      * Flush rewrite rules.
      */