## Task Link
WPS-6603

## Summary
Fixed all PHPCS/WordPress coding standards violations and additional WordPress.org review issues flagged across multiple plugin files. Changes cover:
- Unsanitized `$_GET`, `$_POST`, and `$_SESSION` input variables
- Missing `wp_unslash()` before sanitization
- Replaced `$_GET` access with `filter_input()` for proper input filtering
- Yoda condition violations
- Boolean operator precedence — missing parentheses when mixing `&&` and `||`
- Inline comments missing terminal punctuation
- Missing PHPDoc class comments
- Replaced deprecated `meta_key`/`meta_value` in `wc_get_orders()` with `array_filter()` + `get_meta()` for HPOS compatibility
- Replaced raw SQL `$wpdb->get_col()` with `get_sites()` API
- Removed license deactivation API call on plugin deactivation
- Moved inline SVG `<style>` blocks to external CSS
- Added nonce verification to add-to-cart handler
- Fixed `wp_enqueue_script()` calls (array syntax, plugin version instead of `null`)
- Unified order fetching in My Bookings tab to always use `wc_get_orders()`
- Expanded README.txt External Services section to document all third-party services
- Fixed global calendar hourly booking date/time parsing

## Claude Usage
- Used: Yes
- Purpose: Identify exact lines, understand context, and apply correct PHPCS-compliant and WP standards fixes
- Output generated: Edits across 12 files resolving all reported PHPCS errors and WordPress.org review issues
- What was manually verified/modified: All fixes confirmed via file reads after each edit; no manual modifications needed

## Changes Made
- `public/class-mwb-bookings-for-woocommerce-public.php` — replaced `meta_key`/`meta_value` in `wc_get_orders()` with `array_filter()` (×3); fixed `wp_enqueue_script()` calls; added `addToCartNonce` to localized data
- `public/js/mwb-global-booking-shortcode.js` — appended `mwb_booking_nonce` to add-to-cart URL
- `public/partials/wps-mybookings-details-tab.php` — unified order fetching to always use `wc_get_orders()`, removed `OrderUtil` legacy fallback
- `admin/class-mwb-bookings-for-woocommerce-admin.php` — replaced `meta_key`/`meta_val` in `wc_get_orders()` with `array_filter()` (×2); replaced `meta_query` on `_airbnb_ical_link` with `array_filter()`; fixed hourly booking date/time parsing; moved inline CSS to JS
- `admin/css/mwb-admin-global-custom.css` / `.min.css` — added `.wps-info-img .cls-1 { fill: #1e1e1e; }` (moved from inline SVG)
- `admin/js/mwb-admin-global-custom.js` — injected CSS hiding `#edit-slug-box`, `#view-post-btn`, `.post-preview` for `wps_global_booking` post type (moved from PHP)
- `admin/image/services.svg` — removed inline `<style>` block (fill now in external CSS)
- `includes/class-mwb-bookings-for-woocommerce-activator.php` — replaced raw SQL with `get_sites(['fields' => 'ids'])`
- `includes/class-mwb-bookings-for-woocommerce-deactivator.php` — removed license deactivation API call; replaced with `delete_option('mwb_mbfw_is_booking_enable')`
- `includes/class-mwb-bookings-for-woocommerce-onboarding-steps.php` — replaced `$_GET['page']` with `filter_input()` (×2)
- `mwb-bookings-for-woocommerce.php` — replaced `$_GET['page']` with `filter_input()` (×2); added nonce check to add-to-cart handler; fixed `wp_register_script()` formatting; hidden "Go Pro" link; removed inline `<style>` from SVG action links
- `README.txt` — updated version headers; significantly expanded External Services section

## Testing
- Tested locally: Yes
- Edge cases covered: HPOS-compatible order queries verified; nonce flow tested end-to-end on add-to-cart

## Screenshots / Demo (if applicable)
N/A

## Checklist
- [x] Code reviewed by self
- [x] No unnecessary code
- [x] Proper naming conventions
