Narrows return types based on a configurable table-to-entity-class
mapping (nette.database.mapping.tables), which is not yet part of the
nette/database distribution. Kept as the topmost commit so the whole
feature can be excluded or rebased independently.

Includes:
- TableRowTypeResolver shared resolver
- Explorer::table() -> Selection<EntityRow>
- ActiveRow::related() -> GroupedSelection<EntityRow>
- ActiveRow::ref() -> ?EntityRow
- Selection::insert() -> mapped EntityRow

The readme is what a project needs to switch to version 4, AGENTS.md what an
agent needs before touching this repository, and docs/internals.md how the
extension, the presets, the filter, the ecs entry point and the migration fit
together.

The Coding Style workflow runs the check in CI, manually until DressCode is
published.

ncs.php and ncs.xml are read through the rule aliases of DressCode and what
has no counterpart is reported instead of silently dropped. The fixers and the
sniff version 3 had of its own are translated here, since DressCode knows
nothing of them.

check and fix with paths, --fix, --no-progress, -V and -h are translated and
handed to DressCode. A php* preset of version 3 maps to the standard itself,
because the PHP version now comes from the project; optimize-fn, clean-code
and types map onto their preset classes. --config-file is refused with a
message pointing at dresscode.neon.

Without a configuration file the binary applies the standard, the extension
and the src and tests directories, which is what version 3 did by itself.

The presets of this package are reachable only by class until something
registers them, and the exclusions and the file filter version 3 had built in
have to arrive somehow too. The extension carries all three, so a project
names it in dresscode.neon next to the dresscode/nette preset. It enables no
preset: which of them apply is the decision of the project, and since the
extension is a layer below it, the configuration file overrides whatever it
likes.

Parameters, return values and properties take them from their annotations,
and a nullable type is written ?T.

Strict comparisons, no useless else, final internal classes, no unset on
properties, ternaries, direct calls of invokables, no type kind in a name,
early exits and static closures.

The rule imports the functions the PHP compiler replaces with an opcode when
it knows them as global, and along with them the PHP_* constants and
DIRECTORY_SEPARATOR.

A file declaring a newer version than the runtime is left unchecked. The
annotation is matched anywhere in the file content, so a file that merely
quotes it is skipped too.

The composer manifest, the CI workflows and the test bootstrap. The package is
a plugin of DressCode, not a checker of its own: the engine, the rules and the
configuration API all come from there.

The php-coveralls phar is replaced by coverallsapp/github-action, which
resolves the token and the absolute paths in the Clover report on its
own, so tests/.coveralls.yml is no longer needed.

Coverage is now uploaded even when tests crash under phpdbg. Being
phpdbg-compatible is not a goal, but until now the failing step aborted
the job before the upload ever ran. The job-level continue-on-error is
gone, so genuine failures, including a rejected upload, are visible.

Node.js 20 reached end of life in April 2026. The CI matrix now runs
22 and 24, package.json declares engines >= 22, and the runtime guard
around fs.globSync is gone, so glob entries work on every supported
version. Also bumped actions/setup-node from v4 to v7.

Documents every plugin option (entry, refresh, host, appUrl, infoFile),
the Vite defaults the plugin injects, dev-mode detection via the info file,
and the CORS/Docker/proxy/network recipes.

Review follow-ups:
- fs.globSync exists only on Node 22+, but Vite 6 supports Node 18+;
a glob entry on an older runtime threw a cryptic 'not a function'.
Throw a clear error from the glob branch instead.
- The signal handler removed info files and then called process.exit(0),
which re-ran the same cleanup via the 'exit' handler. Let signals just
exit; the single 'exit' handler owns cleanup.

Nette\Security appeared in no skill at all; the same held for sessions,
routing, caching, mail, the component tree and the retired-name lookup.

The scope of each was set by measuring what models actually produce rather
than by the size of the documentation, so they document the traps instead of
teaching the topic and are far shorter than a full guide. Every claim was
verified against the library source at a named tag, most of them by running
the code, and all seven were then re-checked by an independent pass.

- nette-security: the Authenticator contract and its error codes,
SimpleIdentity against the 2.x names, Passwords as a service with instance
methods, logout() keeping the identity, sliding expiration, the Permission
ACL including last-parent-wins, IdentityHandler for stale roles
- nette-components: factories, signals and where they run, why a form submit
is not a signal, what {plink} really is, persistent parameters,
redrawControl against the nonexistent invalidateControl, payload.redirect
during AJAX, dynamic snippets, the argument-free getComponents()
- nette-routing: that route order governs link generation and not only
matching, one-way routes, filter order, canonicalization, and that
cache: true cannot serialize a closure filter
- nette-http: the Sec-Fetch based CSRF protection, that any non-browser
client fails it quietly, sessions through set/get/remove, the proxy trap,
and the SSRF UrlValidator
- nette-caching: Cache::Expire rather than Expiration, remove() rather than
the nonexistent forget(), which storages need a journal, and that a closure
in Cache::Callbacks is a fatal because the dependency is serialized
- nette-mail: setHtmlBody auto-embedding, addEmbeddedFile returning a
MimePart that must not be concatenated, SmtpMailer having no default
credentials, and the 4.2 additions
- nette-upgrading: retired name to current name across all packages, sorted
by whether the old name still resolves; the aliases sit in an if (false)
branch, so the IDE and PHPStan flag them while nothing fires at runtime

Printing an attribute is the most common thing a template does and 3.1
changed how it behaves, so a model trained on older Latte writes 3.0 code.
Every example here was produced by running it.

Covers the bool, tristate, valued-bool, list, style, data and aria
categories, that the handling applies only when the whole value is one
{...} expression, that a keyed array item counts only when its value is
=== true, and the traps: URL attributes are exempt through the internal
checkUrl filter, and a real filter stringifies the value and defeats the
whole mechanism.

Also prefers class={[...]} over n:class and attribute values over n:attr,
while saying plainly that neither is deprecated and that n:attr remains the
only way to express a dynamic set or name of attributes. Rewriting is not
mechanical: n:class de-duplicates the list and the attribute form does not.

Every claim was checked against the library source, most of it by executing
the snippet; several skills were then re-checked by an independent pass.

- architecture: the lifecycle had signals inside the action phase; they run
after it and after canonicalization. Added afterRender, shutdown, the
events, and that parent::startup() is enforced
- configuration: only presenters are auto-registered, not components; added
generated factories and accessors (implement:)
- forms: {form} attributes need a comma, Numeric is a non-negative integer
rather than an alias for Integer, corrected the renderer wrapper keys,
Nette\Application\UI\Form belongs in a presenter, onValidate must read
values with getUntrustedValues(), and CSRF is now Sec-Fetch based
- database: array keys in where() are SQL, keywords in fragments must be
uppercase, the empty-array trap, transaction() nesting and its return value
- utils: Callback::closure() and Type::allowsNull() do not exist, corrected
the expected output of isBuiltin(), typeToExtension() and firstLower();
added Process, DateTimeImmutable and the Html escaping contract
- tester: annotations, TestCase, helpers and CLI flags; a test with no
assertion is an error and exit() counts as a pass; @phpVersion with a
three-component version skips the very version it requires
- phpstan: the extension reports errors of its own and forces stricter flags
on, so some errors exist only because it is installed
- assets: a Vite mapper needs an explicit path; documented the plugin options
and that refresh, appUrl and host: network are not in the npm release yet
- neon: spaces are valid indentation too, tabs are only a convention