Bump PHPStan to level 3 and fix all resulting issues

[utkarshcloudinary]

Approach

Raise the PHPStan analysis level from 2 to 3 and resolve all 42 resulting errors. All fixes are safe PHPDoc/annotation corrections with no behavior change:

Return-type PHPDoc corrected to match actual behavior

• Assets::generate_storage_signature → bool (returns a comparison result).
• Assets::build_item → array|null (early-returns null on empty input).
• Media::get_transformation → int|string|false (returns the found index or false).
• Media::cloudinary_url → string|null.
• Media::filter_downsize → array|false (short-circuits the image_downsize filter value).
• Media::get_context_options → string (returns an implode()d string).
• Settings::save → string[] (collects pending slugs, only tested with empty()).
• Api::sign → string (returns a sha1()), Api::call → array|string|WP_Error (can return the raw non-JSON body).
• Page::form / Page::notice / Sync::action → array|null.
• On_Off::sanitize_value → string (returns 'on'/'some'/'off').
• Global_Transformations::get_terms → array<array{term: WP_Term, value: mixed}>, which also resolves the offset access on $item['term'] at the call site.

sanitize_value covariance

• Widen the base Text::sanitize_value PHPDoc to mixed so the array/bool overrides (Checkbox, Cron, Crops, React, Tags_Input, On_Off) are covariant-compatible with the parent.

Settings vs. Setting type confusion

• Correct the Component\Settings interface param to Cloudinary\Settings (implementations receive the core Settings, not a Setting).
• Widen Settings_Component::$settings and Delivery_Feature::$settings to Settings|Setting — subclasses narrow the property to a child Setting after init (Extensions, Gallery, Responsive_Breakpoints).
• Align Gallery::$settings, Extensions::$settings, and Global_Transformations::$media_settings PHPDoc with the objects actually assigned.

Property/type fixes

• Setting::$parent is a slug string (set via set_parent()), not self; Setting::get_option_parent() returns Setting|null.
• Sync::$managers now includes Sync_Queue[].
• Line_Stat::$connect typed as Cloudinary\Connect (was shadowed by the UI Connect component) and narrowed at the call site; $used_percent/$limit accept the numeric values get_usage_stat() returns.
• Cast ini_get() in Cron::$daemon_watcher_interval; default Api::$pending_url to null (was array()).
• Widen abstract Url_Object::get_id() to int|string|null (WordPress returns an int post id, Cloudinary returns a string public id).
• Annotate wp_get_attachment_metadata() results in Video as array so the fileformat offset resolves against the image-shaped WP stub.

QA notes

• Run static analysis and confirm no errors at level 3:

  composer phpstan
  

  Expected: [OK] No errors.
• Run code style on the changed files (repo-wide composer lint may OOM; scope to changed files with a raised limit):

  vendor/bin/phpcs -d memory_limit=1G php/class-assets.php php/class-cron.php php/class-delivery-feature.php php/class-extensions.php php/class-media.php php/class-settings-component.php php/class-settings.php php/class-sync.php php/component/class-settings.php php/connect/class-api.php php/media/class-gallery.php php/media/class-global-transformations.php php/media/class-video.php php/settings/class-setting.php php/ui/component/class-line-stat.php php/ui/component/class-on-off.php php/ui/component/class-page.php php/ui/component/class-sync.php php/ui/component/class-text.php php/url/class-url-object.php
  

  Expected: no errors/warnings.
• Since all changes are PHPDoc/annotation-only, no runtime behavior changes. Light smoke test of the touched paths:
  • Settings pages (Page/Sync components) render; form, notice, and sync-action parts still display.
  • Usage stats (Line_Stat / opt-level) render the used/limit line correctly.
  • Video shortcode/player output still resolves the file format.
  • Global transformations taxonomy overrides still apply.
  • Connect API calls (sign/call) still succeed for both JSON and non-JSON responses.