Raise PHPStan to level 1 and fix all findings

[utkarshcloudinary]

Summary

Bumps PHPStan analysis from level 0 to level 1 and resolves every new finding in code rather than baselining, matching the level-0 approach.

composer phpstan → No errors at level 1.

Real bugs fixed

• extract_cname() checked an undefined $test['query'] (typo) instead of the $parsed_url['query'] parameter, so the query-string CNAME branch never ran.
• connection-string.php passed two args to wp_kses_post() (takes 1) and the string was not translated; now uses esc_html__() with a translators comment.
• remove_filter() in class-video.php was called with 4 args (max 3); dropped the stray accepted_args value.

Defensive / dead code simplified

• upgrade_connection() initialises $data and bails when no cloudinary_url is present, instead of accessing a possibly-undefined variable.
• Api::upload() initialises $result before the chunk loop so an empty file returns a WP_Error rather than reading an undefined variable.
• Removed always-falsy $errors guard in Admin::save_settings().
• Removed redundant empty()/elseif branches in Delivery and Upgrade.

Static-analysis support

• url_hash added to the Relationship @property list (valid magic property backed by a DB column).
• State and REST_API constructors now use the injected $plugin instead of get_plugin_instance() / discarding it, removing unused-parameter warnings.
• New tests/phpstan/stubs/constants.php declares runtime-defined constants (CLDN_*, CLOUDINARY_ENDPOINTS_*, CLOUDINARY_CONNECTION_STRING) and the WP core constants WPINC/LOGGED_IN_COOKIE that the stub package omits.
• Exclude php/templates/* since view files are included into a class scope, so $this is bound at runtime in a way PHPStan cannot model standalone.

Test plan

• composer phpstan reports no errors at level 1
• phpcs passes on changed files