CataSync feeds 1/6: connector 0.9.0 read endpoint /catalog

Imported from GitHub issue El-SaMa/oma#244 by @El-SaMa.

---

Part of the Product feeds epic. Build first.

What

Add a signed, read-only REST route POST /wp-json/lafu-catasync/v1/catalog to ops/catasync/plugins/lafu-catasync-connector that returns published products with everything a feed needs. Version 0.9.0.

Exact spec

• Register in includes/class-lafu-catasync-connector-rest.php next to /inventory, same permission_callback (Lafu_Catasync_Connector_Auth::verify), same WooCommerce-missing guard.
• Params: page (>=1), per_page (1..100, default 100), optional modified_after (ISO 8601 UTC; return only products with date_modified after it).
• Implement Lafu_Catasync_Connector_Products::catalog( $page, $per_page, $modified_after ) in class-lafu-catasync-connector-products.php using wc_get_products with status => publish, type => simple, variable, orderby => ID, order => ASC, paginate => true, plus date_modified => '>' . timestamp when given.
• Variable products: one row per purchasable, published variation (with item_group_id = parent id) plus no row for the parent. Simple: one row.
• Row fields (all strings or null, never PHP notices): id, parent_id, sku, ean (get_global_unique_id), mpn (meta _lafu_catasync_mpn if present else null), name, short_description and description (raw HTML, edit context), permalink (get_permalink), image (main image URL), gallery (array of URLs, max 10), regular_price, sale_price, price (wc_get_price_including_tax with the shop's tax display, 2 decimals), currency (get_woocommerce_currency), stock_status, stock_quantity, backorders, weight, shipping_class (slug or null), categories (array of full paths like Tietokoneet > Näytönohjaimet), brand (first product_brand term name or null), energy_class (meta _lafu_eu_energy_class), lead_text (meta _lafu_catasync_lead_text), catasync_id (meta _lafu_catasync_id or null), date_modified (ISO UTC).
• Response: { items: [...], total, pages, now } where now is the server time ISO UTC (engine uses it as the next modified_after).
• Performance: prime caches (_prime_post_caches, update_meta_cache) for the page; no per-row get_terms loops beyond what WooCommerce caches. A 100-row page must answer in under 2 s on niletech.
• readme.txt changelog + Stable tag + plugin header + LAFU_CATASYNC_CONNECTOR_VERSION all 0.9.0.

Not in scope

No writes, no settings page changes, no Google code in the plugin.

Acceptance

• Gate scripts/wp-plugin-gate-remote.sh ops/catasync/plugins/lafu-catasync-connector = 0 errors 0 warnings; security check written in the PR/commit notes (auth, escaping not needed for JSON, no unbounded queries).
• Installed on maxfort.fi first; signed call returns rows for simple and variable products, modified_after filters correctly, timing logged.
• Then installed on niletech the same way earlier versions were (see ops/catasync/README / handbook CataSync section "Connector"); 100-row page < 2 s measured.
• Handbook line added (connector routes list).

Binding rules (read before coding)

• Read CLAUDE.md and every .cursor/rules/*.mdc with alwaysApply: true first. They win over your defaults.
• No OpenAI / AI calls anywhere in this feature. CataSync AI switch (ai_enabled) stays off. Never turn it on.
• Smallest correct change. Match the surrounding code style (engine = plain ESM .mjs, mysql2 pool from src/db.mjs; core-api = TypeScript).
• Every staff action goes through the admin MCP (admin-mcp-first.mdc): executor in services/core-api/src/agent-tools/tools-catasync.ts, confirm handler in services/core-api/src/platform/confirm.ts for writes, registry entry, zod schema in services/mcp-server/src/tools.ts, test in tools-catasync.test.ts. The UI calls the same tool (via apps/web/lib/catasync/admin-actions.ts), never a separate path.
• UI: vertical side nav only (never a second tab row), forms in modals, shadow cards, full width (portal-chrome.mdc).
• Every string: next-intl key with native en, fi, sv (Finnish must read native, not translated). No em/en dashes in prose. Run node scripts/i18n-validate.mjs.
• Handbook: update apps/web/content/admin-docs/products/catasync.md (new section) for every behaviour you add.
• Secrets (tokens, Google tokens, feed tokens) never in logs, commits, handbook or chat.
• Commits: author ELSAMA only, no Co-authored-by / AI attribution. Push to main right after each commit (rebase on origin/main first).
• Deploy: engine with bash scripts/catasync-engine-roll.sh figaro; OMA only via the train bash scripts/deploy-quick.sh (never set OMA_DEPLOY_SERVICES, never build on the VM). Check the live SHA contains your commit.
• WordPress plugin changes: bump version, pass scripts/wp-plugin-gate-remote.sh ops/catasync/plugins/lafu-catasync-connector with 0 errors 0 warnings + security check (wp-plugin-dod.mdc). Install on maxfort.fi first (test shop), only then niletech.
• Never change niletech prices, statuses, shipping rows or the Code Snippets / table-rate plugins as part of this work.
• Clean up test data and temp files when done.