Visitor Traffic Real Time Statistics pro v11.11

* Security: hardened all report REST routes and admin AJAX endpoints against SQL injection by parameterizing every query and forcing pagination values to integers. * Security: fixed a stored/second-order SQL injection where the custom timezone setting was saved without validation; timezone values are now validated against known timezone identifiers and UTC offsets before storage. * Security: added capability checks to the admin-facing statistics AJAX endpoints so site analytics can no longer be requested by unauthenticated or low-privilege users. * Security: fixed reflected XSS and SQL injection in the IP history endpoint (output escaped, inputs sanitized and parameterized). 11.10 * performance improvements