[justlevine]

What

Cleans up the settings screen and how brand site data is stored:

• Site type setup moves from a modal into the settings page.
• Brand site API keys are now stored encrypted, and neither they nor the consumer key are exposed through /wp/v2/settings.
• Brand site URLs must be http or https.

Why

Aligns with OneSearch:

• The site type modal was a separate onboarding bundle and stylesheet, injected into the footer of the Plugins page and every OneDesign screen. It was a lot of code for one dropdown, and it opened on top of the screen.
• onedesign_shared_sites was registered with show_in_rest, so every brand site's API key came back in plain text from /wp/v2/settings. The consumer key was exposed there too: core returned the encrypted value, and a key saved through that route would be stored unencrypted.
• isValidUrl() accepted any URL that new URL() could parse, including javascript: and ftp:.
• settings/index.tsx held the whole page, and the components each declared their own copy of the brand site and notice types.

Related Issue(s):

• Follows fix: set up the site type inline and only load assets on OneSearch screens onesearch#340, fix: handle brand sites through the governing site's server onesearch#353, fix: admin settings cleanup onesearch#362

How

• URLs: isValidUrl() checks for the http: or https: protocol, and the URL field's help text says so.
• Settings page: the page moves from settings/index.tsx into settings/page.tsx. MultiSites, SiteModal and SiteTable now use its BrandSite, NoticeType and defaultBrandSite types, and imports use the @/ alias. The @wordpress/dependency-group lint rule is dropped, since the files no longer use those comment groups.
• Site type: a new SiteTypeSettings card shows on the settings page while no site type is set. It saves to /wp/v2/settings and reloads the page. The onboarding entry point, script, stylesheet, footer markup and body class are removed. On the Plugins page and the Dashboard, a dismissible admin notice links to the settings page instead. SiteType lives in the new types/global.d.ts.
• Brand keys: set_shared_sites() encrypts each key with Encryptor, and get_shared_sites() decrypts it. onedesign_shared_sites and onedesign_consumer_api_key are no longer registered with show_in_rest. The OneDesign REST routes still read and write them.
• Adds PHPUnit tests for Admin and Settings, and Vitest tests for SiteTypeSettings and isValidUrl(). Removes the e2e test for the old modal.

AI Disclosure

Claude Code migrated the draft changes from OneSearch, wrote the tests and the initial draft of the PR description.

Testing Instructions

Screenshots

Additional Info

Brand keys saved before this PR aren't migrated. They're stored unencrypted, so they read back empty and have to be re-entered on the governing site.

Checklist

• I have read the Contribution Guidelines.
• I have read the Development Guidelines.
• I have added necessary tests to cover my changes.
• I have updated the project documentation as needed.
• My code has detailed inline documentation.
• My code is tested to the best of my abilities.
• My code passes all lints, tests, and checks.