feat: add internal WordPress cron runner

docs/adr/0001-wordpress-single-page.md

@@ -17,10 +17,12 @@ classic theme for exact semantic markup and responsive design. Store homepage fi
 sanitized theme modifications, while a must-use plugin owns Shows and Gallery custom
 post types so structured content is not lost when changing themes.
 
-NGINX is the only public entry point. WP-CLI provides an idempotent opt-in bootstrap;
-Certbot provides opt-in direct TLS. Docker networks isolate the database. Runtime state
-uses host-based bind mounts with a preparation script for ownership/mode, while
-functional tests use separate Docker volumes.
+NGINX is the only public entry point. Public `wp-cron.php` requests stay blocked, while
+an internal WP-CLI based `wp-cron` service runs due scheduled events over the private
+data network. WP-CLI provides an idempotent opt-in bootstrap; Certbot provides opt-in
+direct TLS. Docker networks isolate the database. Runtime state uses host-based bind
+mounts with a preparation script for ownership/mode, while functional tests use
+separate Docker volumes.
 
 ## Consequences
 
@@ -30,6 +32,8 @@ functional tests use separate Docker volumes.
 - Core/theme/plugin patches require an image rebuild in production.
 - Fixed participation cards remain code until editorial requirements justify another
   structured content type.
+- Scheduled WordPress jobs depend on the internal `wp-cron` service instead of visitor
+  traffic.
 
 ## Alternatives considered
 
@@ -43,8 +47,9 @@ functional tests use separate Docker volumes.
 
 The architecture inherits WordPress's public CMS attack surface. The implementation
 reduces it with network isolation, no direct application port, disabled file editing
-and XML-RPC, production immutability, sanitization/escaping, rate limiting, security
-headers, and fail-closed TLS. Admin MFA and allowlisting remain external controls.
+and XML-RPC, production immutability, sanitized/escaped rendering, no bundled demo
+plugins, internal-only scheduled jobs, rate limiting, security headers, and fail-closed
+TLS. Admin MFA and allowlisting remain external controls.
 
 ## Operational impact