feat: validate WordPress × PHP image combo before pulling

[kjellbergzoey]

What

Adds a best-effort preflight that validates the configured WordPress × PHP combination against Docker Hub before kiqr up (and kiqr restart) try to pull the image.

Not every wordpress:<ver>-php<php> tag is published — for example wordpress:6.4-php8.5 and wordpress:6.7-php8.5 do not exist — so a docker compose pull would otherwise fail with a confusing low-level error. This directly addresses the WordPress × PHP combo concern raised in review on the merged #13.

How

New src/lib/image-tags.ts — pure and fetch-injectable so it is unit-testable without the network:

• wordpressImageTag(version, php) — mirrors BitnamiRuntimeProvider.getWordPressImage's tag scheme (php8.3 for latest, 6.7-php8.3 for a pinned version).
• wordpressTagExists(tag, fetchImpl) — GET /v2/repositories/library/wordpress/tags/<tag>; 200 → true, 404 → false, any other status or thrown error → null.
• availablePhpVersionsFor(version, fetchImpl) — lists the PHP versions that ARE published for a WordPress version (sorted, de-duplicated); [] on error.
• validateWordPressPhp(version, php, fetchImpl) — returns {ok, tag, message?, availablePhp?}.

Wired into up.tsx and restart.tsx as a StepRunner step ("Validating WordPress + PHP version…") that runs before the docker compose up step. It throws the actionable .message when the combo is confirmed missing, pointing the user to fix wordpress.php_version in kiqr.yaml. Docker invocation logic is unchanged.

Best-effort by design (never blocks offline)

The check only fails on a positively confirmed missing tag (HTTP 404). Any unknown result — network failure, offline, rate-limit, unexpected status — resolves to null and the step passes, so kiqr up is never blocked by Docker Hub being unreachable.

Tests

tests/lib/image-tags.test.ts uses an injected mock fetch (no network): tag-building combos, wordpressTagExists (200/404/500/throw), availablePhpVersionsFor parsing/sorting/error paths, and validateWordPressPhp for exists→ok, missing→{ok:false} listing available PHP, and network-null→ok.

npm run typecheck, npm test (130 passing), and npm run build all green.

Note: this PR intentionally does not add Biome or biome.json; the new/changed code is written to match the style in #10.

🤖 Generated with Claude Code

[kjellbergzoey]

Rebased onto current main (which now includes Biome #10 and the kiqr agent #22). The conflict was purely the Biome reformat of up.tsx/restart.tsx; re-applied the "Validating WordPress + PHP version..." step cleanly on top, placed right before the containers start. Now green: lint, typecheck, 192 tests, build all pass. Ready to merge. 🤖