fix: code quality cleanup — DI, dedup, CSP, reflection, dead code

[rhoerr]

Summary

• Replace ObjectManager usage with constructor DI in Toolbar and Panel blocks
• Inject SerializerInterface in Helper/Data, fix and → && operators
• Hash session IDs in temp filenames, add cleanup in shutdown path
• Fix cache dedup bug ($cacheEvents → $this->cacheEvents)
• Remove static CSP script-src hashes (SecureRenderer handles nonces)
• Guard reflection calls with try/catch \ReflectionException
• Remove dead Response plugin
• Fix Elasticsearch::pullData() return type
• Scope window.fetch monkey-patch in dumper.phtml

Security Findings Addressed

ID	Finding	Severity
M7	ObjectManager usage instead of DI	Medium
M8	Raw session ID in temp filenames	Medium
M9	Static CSP hashes are fragile	Medium
H10	Cache dedup bug (missing $this->)	Hygiene
H11	Unguarded reflection calls	Hygiene
H12	Dead Response plugin	Hygiene

Test plan

• Verify toolbar base URL still resolves correctly
• Verify panel tab AJAX URLs still work
• Verify config serialization still works
• Verify temp files use hashed names
• Verify cache tab shows deduplicated entries
• Verify CSP does not block toolbar scripts
• Verify plugin tab and layout block tree still render
• Verify dumper tab fetch interception still works

🤖 Generated with Claude Code