Add PHPStan for a little sanity - Good first issue

[mhsdesign]

I wondered how we still stumble on runtime bugs like these #427 that are totally unavoidable when using static analysis.

    "scripts": {
        "lint:phpstan": "../../../bin/phpstan analyse --level 8 Classes"
    },

I would have commited that already and added it to the CI if it werent for the "195 errors" ... even level 4 reports ~100 errors so i think this package is due to become a little safer.