Fix the findings of a full second security audit

Four-part audit (OIDC/JWT/crypto, user sync, admin UI, login bypasses)
with dynamic PoCs against a real WordPress install; every fix is covered
by a regression test. Report: docs/security-audit.md, section 6.

Critical/High
- Multisite: settings, AJAX actions and certificate download require
  manage_network_options (site admins could sign in as super admin).
- Privileged accounts are only linked (sync and first sign-in) via a
  matching UPN of a member account, never via the settable mail
  attribute; the sync never changes their e-mail address; e-mail change
  notifications stay on.
- Button-only mode exempts by credential (application passwords, WP-CLI)
  instead of request context, closing bypasses through xmlrpc.php and
  REST login handlers; API requests never receive login cookies.
- Multi-tenant mode refuses guest/external identities.

Medium/Low
- Same message for right and wrong passwords; button-only no longer
  switches off when the connection breaks; server-side fallback cookie
  expiry; correct fallback key beats IP lockouts; right-most proxy hop;
  higher start limit; one object ID per account.
- Deactivation sets a random password, revokes application passwords and
  removes the role (restored on reactivation); disabled people are
  deactivated even when their mail vanished; duplicate bindings handled.
- Sync: abort on empty directory answer, no deprovisioning right after a
  tenant change, atomic run lock, strict photo path validation.
- Certificates: key bundles refused, clean re-exported certificate.
- Array-safe sanitising, encoded redirect_to, per-action nonces, escaped
  role lists, no Graph sleeps during sign-in, warnings for public groups,
  multi-tenant group rules and missing salts, uninstall clears the token.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

uninstall.php

@@ -17,7 +17,18 @@ global $wpdb;
 function m365_login_uninstall_site() {
 	global $wpdb;
 
+	// Cached Graph app token (may live in a persistent object cache instead of the options table).
+	$settings = get_option( 'm365_login_settings', array() );
+	if ( is_array( $settings ) && ! empty( $settings['client_id'] ) ) {
+		$tenant = ! empty( $settings['tenant_id'] ) ? $settings['tenant_id'] : 'organizations';
+		foreach ( array( 'secret', 'certificate' ) as $method ) {
+			delete_transient( 'm365_login_apptoken_' . md5( $tenant . '|' . $settings['client_id'] . '|' . $method ) );
+		}
+	}
+
 	delete_option( 'm365_login_settings' );
+	delete_option( 'm365_login_sync_lock' );
+	delete_option( 'm365_login_sync_tenant' );
 	delete_option( 'm365_login_sync_report' );
 	wp_clear_scheduled_hook( 'm365_login_sync' );