Fix false "XML-RPC Disabled" card on rate-limited self-hosted sites

[adalpari]

Description

App-password self-hosted sites could wrongly show the "XML-RPC Disabled" My Site card even when XML-RPC is actually enabled. The root cause: a transient HTTP 429 (rate-limit) from the site's xmlrpc.php was treated as "XML-RPC unavailable" in two places.

1. Discovery succeeds at login, then the authenticated XML-RPC fetch 429s. SiteStore.fetchSitesXmlRpcFromApplicationPassword fell back to the WPAPI path and discarded the already-verified endpoint. It now persists the verified endpoint on the WPAPI-stored site via the new URL-keyed SiteSqlUtils.updateXmlRpcUrlForWPAPISite (ORIGIN_WPAPI-scoped, mirroring updateWpApiRestUrlForWPAPISite).

2. Discovery itself 429s. DiscoveryXMLRPCClient.listMethods silently swallowed the 429 as an empty response, so discovery reported MISSING_XMLRPC_METHOD / NO_SITE_ERROR — indistinguishable from a genuinely disabled site. A new DiscoveryError.RATE_LIMITED is now thrown on 429 and propagated through verifyXMLRPCUrl / checkXMLRPCEndpointValidity.
⚠️ Gotcha: Volley's ClientError (429) extends ServerError, so the 429 has to be handled inside the ServerError branch, before the 405 check.

Card behavior. ApplicationPasswordViewModelSlice no longer shows the warning optimistically. attemptXmlRpcRediscovery surfaces the card only on a definitive negative discovery result (NO_SITE_ERROR, MISSING_XMLRPC_METHOD, XMLRPC_BLOCKED, XMLRPC_FORBIDDEN); transient/unknown failures keep it hidden and re-check on the next refresh. It also bails on the first 429 instead of firing a burst of discovery requests that re-trigger the rate limit.

Genuine detection is preserved: a truly disabled site (clean 404/405/403, no 429) still surfaces the warning.

Testing instructions

XML-RPC card is not falsely shown on a rate-limited site:

1. Create a fresh WordPress site on jurassic.ninja (these sandbox sites aggressively rate-limit xmlrpc.php with HTTP 429).
2. Confirm XML-RPC is enabled on the site (it is by default).
3. In the app, log in to that site via Application Password (enter the site URL and authorize).
4. Open the My Site screen for that site.

• Verify the "XML-RPC Disabled" card is not shown.

Genuine "disabled" detection still works:

1. Log in (app password) to a self-hosted site that has XML-RPC actually disabled (e.g. https://xmlrpc-disabled-by-plugin.wpmt.co/).
2. Open the My Site screen.

• Verify the "XML-RPC Disabled" card is shown. NOTE: Card can appear/dissapear due to multiple retries, but the final state must be shown.

[dangermattic]

	1 Warning
⚠️	PR is not assigned to a milestone.

Generated by 🚫 Danger

[wpmobilebot]

📲 You can test the changes from this Pull Request in WordPress Android by scanning the QR code below to install the corresponding build.

	App Name	WordPress Android
	Build Type	Debug
	Version	pr23120-5abca4d
	Build Number	1498
	Application ID	org.wordpress.android.prealpha
	Commit	5abca4d
	Installation URL	5prk0k62c4lrg

Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

[wpmobilebot]

📲 You can test the changes from this Pull Request in Jetpack Android by scanning the QR code below to install the corresponding build.

	App Name	Jetpack Android
	Build Type	Debug
	Version	pr23120-5abca4d
	Build Number	1498
	Application ID	com.jetpack.android.prealpha
	Commit	5abca4d
	Installation URL	6ddoembl05aig

Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

[codecov]

Codecov Report

❌ Patch coverage is 69.69697% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 37.71%. Comparing base (8abbdf1) to head (5abca4d).
⚠️ Report is 1 commits behind head on trunk.

Files with missing lines	Patch %	Lines
...ationpassword/ApplicationPasswordViewModelSlice.kt	80.95%	1 Missing and 3 partials ⚠️
...xc/network/discovery/SelfHostedEndpointFinder.java	0.00%	4 Missing ⚠️
...fluxc/network/discovery/DiscoveryXMLRPCClient.java	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##            trunk   #23120      +/-   ##
==========================================
+ Coverage   37.68%   37.71%   +0.02%     
==========================================
  Files        2343     2343              
  Lines      127342   127365      +23     
  Branches    17658    17667       +9     
==========================================
+ Hits        47995    48033      +38     
+ Misses      75414    75394      -20     
- Partials     3933     3938       +5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[nbradbury]

Fix is good