Initiate Meetup recovery in the administrator browser

[obenland]

Adds authenticated browser initiation for Meetup recovery. The admin dashboard shows a “Reconnect Meetup” link that generates OAuth state in the current administrator's session. The callback dispatcher checks the administrator capability and nonce during admin_init, after WordPress loads the current user.

Companion to WordPress/wporg-mu-plugins#775. Deploy both changes together: MU-plugins recovery warnings now point to this local initiation page, and its OAuth client validates the returned nonce. This also keeps session-bound state and encoded redirect parameters out of cron and Slack recovery messages.

How to test the changes in this Pull Request:

1. Use this branch with the companion MU-plugins branch. Open /wp-admin/?action=wcorg-meetup-authorize as a network administrator and confirm the “Reconnect Meetup” link appears. Verify it does not appear for an unauthorized user.
2. Follow the link and complete Meetup authorization. Confirm the callback stores the token. Invalid state and unauthorized callbacks must not initiate an exchange.
3. Generate a recovery warning from cron or CLI and verify its local link remains usable after WordCamp's Slack text sanitization.

Validation

• Both changed PHP files pass the WordCamp PHPCS configuration.
• Dispatcher regression tests pass under WordPress multisite: 2 tests, 10 assertions.
• Combined recovery flow through the actual dispatcher and MU-plugins client passes with mocked HTTP: 1 test, 6 assertions.
• The companion MU-plugins suite passes: 37 tests, 131 assertions.

Live Meetup authorization, the full WordCamp test suite, and hosted CI were not verified locally.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[obenland]

Closing this companion PR because OAuth protocol changes have been removed from WordPress/wporg-mu-plugins#775. That PR now preserves the existing callback protocol and requires no WordCamp deployment. This branch is retained for separate OAuth hardening work.