enroll(wordpress): test suite + bridge POLL_REPOS entry

Enrolls wordpress as a maintained recipe (operator request 2026-08-03):
- tests/wordpress/: recipe_meta (install-wizard-aware health 200/302, 900s deploy
  timeout for mariadb+core-copy first boot, WARM_CANONICAL), custom suite:
  health check, install-wizard completion + REST API round-trip (?rest_route= vs
  /wp-json/ splits DB vs .htaccess failure layers), and the sec4.3 post round-trip
  (XML-RPC write -> REST read -> permalink HTML, unique marker). PARITY.md documents
  the baseline (no recipe-maintainer parity corpus for wordpress).
- nix/modules/bridge.nix: POLL_REPOS += recipe-maintainers/wordpress (!testme bridge
  enrollment; deploy to the cc-ci host follows separately after the in-flight
  /upgrade-all run - test-before-switch policy).

Mirror recipe-maintainers/wordpress created + main synced to coopcloud upstream
(adcd0e9f) with published tags. used-recipes.md gains 'wordpress weekly' in the
orchestrator repo.

tests/wordpress/custom/test_install_and_api.py

@@ -0,0 +1,41 @@
+"""wordpress — complete the install wizard, then read the site back via the REST API.
+
+Non-vacuous: the install POST writes the site options + admin user to mariadb through the
+app's DB wiring; `/wp-json/` only returns the site name after WP can read those options back
+from the DB, and the pretty-permalink REST route additionally proves the recipe's .htaccess
+rewrites are live. A wedged DB fails the install; a missing htaccess breaks /wp-json/ (the
+`?rest_route=` fallback is asserted separately so the failure names the broken layer).
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(__file__))
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "..", "runner"))
+from _wp import BLOG_TITLE, ensure_installed  # noqa: E402
+from harness import http as harness_http  # noqa: E402
+
+
+def test_install_and_rest_api_roundtrip(live_app):
+    ensure_installed(live_app)
+
+    # ?rest_route= works regardless of rewrites — isolates "REST API up + DB readable"
+    status, body = harness_http.http_get(f"https://{live_app}/?rest_route=/", timeout=60)
+    assert status == 200, f"GET /?rest_route=/ HTTP {status}"
+    assert isinstance(body, dict), f"REST index is not JSON: {body!r}"
+    assert body.get("name") == BLOG_TITLE, (
+        f"site name mismatch: got {body.get('name')!r}, expected {BLOG_TITLE!r} — "
+        "install options did not round-trip through the DB"
+    )
+
+    # /wp-json/ additionally requires the recipe's .htaccess rewrite rules
+    status, body = harness_http.http_get(f"https://{live_app}/wp-json/", timeout=60)
+    assert status == 200, (
+        f"GET /wp-json/ HTTP {status} — REST works via ?rest_route= but the pretty route "
+        "fails: the recipe's .htaccess rewrites are not active"
+    )
+    assert isinstance(body, dict) and body.get("name") == BLOG_TITLE, (
+        f"unexpected /wp-json/ payload: {body!r}"
+    )