PHPStan levels are a ratchet, not a target

The levels run 0 to 7 and the instinct is to aim for the top, which on an existing codebase produces thousands of errors and no way to start. They are designed to be climbed one at a time, with the current one enforced.

# phpstan.neon — the number is a floor that only goes up
parameters:
    level: 3
    paths: [src]

# 0  unknown classes and functions
# 1  undefined variables, unknown magic methods
# 2  unknown methods on all expressions
# 3  return types, property assignment types
# 4  dead code, always-false conditions
# 5  argument types passed to methods
# 6  missing type hints
# 7  partially wrong union types

Level 5 is where most of the real bugs are and level 6 is where the arguments start, because it demands annotations for things nobody has written down. Raise the level in its own commit with nothing else in it, so the diff is reviewable and the revert is clean if it turns out to be premature.