Model: Handle dates in UTC and keep column fields out of message meta - #627

What?

Closes #614. Part of #302.

Makes Helper\Serde read and write dates in UTC, removes column fields from Message::$meta_keys, and makes Factory\Message deserialize its dates the same way the other factories do.

Why?

• Serde depended on the PHP default timezone. maybe_deserialize_mysql_date() called DateTime::createFromFormat() without a timezone. WordPress sets the default to UTC, but anything that changes it shifts every date read from the database. It also accepted dates like 2024-02-30, which PHP silently rolls over to March.
• Column fields leaked into meta. Message::$meta_keys listed expires_at, severity and channel_title, so encode_meta() wrote them into the meta JSON (expires_at as {"date":…,"timezone_type":3,"timezone":"UTC"}). jsonSerialize() overwrote them afterwards, which hid the problem.
• Factory\Message could not load a message from the database. It passed created_at / expires_at straight to the model, whose properties are typed ?DateTime, so a MySQL date string threw TypeError: Cannot assign string to property … of type ?DateTime. Implement querying the database for notifications #307 would hit this first.

How?

includes/helper/class-serde.php

• maybe_deserialize_mysql_date() parses with !Y-m-d H:i:s in UTC (! also resets microseconds).
• Dates PHP would roll over (e.g. 2024-02-30, month 13, the MySQL zero date) and non-string values now return null.
• A DateTime passed in is converted to UTC without modifying the original.
• maybe_serialize_json_date() always outputs UTC (+00:00).

includes/model/class-message.php

• Removed expires_at, severity and channel_title from $meta_keys.
• jsonSerialize() still includes channel_title and severity, so the REST response has the same fields (only the key order changes).
• Removed the unused validate_message(). Its 255-byte limit would not match the TEXT column planned in Database schema v2 #615.

includes/factory/class-message.php

• created_at and expires_at go through Serde::maybe_deserialize_mysql_date(), matching the Notification and Subscription factories.

Tests

• New tests/phpunit/tests/test-serde.php (14 tests). It sets the PHP default timezone to America/New_York to prove Serde doesn't depend on it, and covers the round trip, DateTime conversion, no mutation of the input, and invalid input.
• test-model-message.php: updated the pinned JSON order and added two encode_meta() tests.
• test-factory-message.php: added a test that makes a message from MySQL date strings.

With the old code, 11 of the new tests fail (10 assertion failures, 1 TypeError).

Testing Instructions

1. npx wp-env start
2. Run the suite:
   npx wp-env run tests-cli --env-cwd=wp-content/plugins/wp-feature-notifications vendor/bin/phpunit
3. Run it as multisite:
   npx wp-env run tests-cli --env-cwd=wp-content/plugins/wp-feature-notifications env WP_MULTISITE=1 vendor/bin/phpunit
4. Run only the affected tests:
   npx wp-env run tests-cli --env-cwd=wp-content/plugins/wp-feature-notifications vendor/bin/phpunit --filter "Test_Serde|Test_Model_Message|Test_Factory_Message"

Local results: 79 tests, 0 failures on single site and multisite (the 24 skipped are the existing REST controller placeholder tests). PHPCS is clean.