fix: replace esc_attr() misuse with proper input sanitization

[akshayurankar48]

Summary

• Replace esc_attr() on $_POST/$_GET with sanitize_text_field(), absint(), or intval() depending on data type
• Add wp_unslash() before sanitization on superglobal access
• Fix nonce values to use sanitize_text_field(wp_unslash()) before wp_verify_nonce()
• Fix post IDs to use absint() instead of esc_attr()
• Fix star ratings to use intval() instead of esc_attr()

Files changed

• init.php — meta box save, file upload, oEmbed handler
• functions.php — rating AJAX handlers
• admin/index.php — settings reset handler

Test plan

• Verify meta box save still works on post edit screens
• Verify rating submission still works on frontend
• Verify settings reset buttons work in admin dashboard
• Verify oEmbed preview in post editor still works

Fixes #219