feat(v3.13.0): settings live DB reads, remove Directus/Appwrite, admin stats

Settings fixes:
- MAX_SITES_PER_USER, USER_RATE_LIMIT_PER_MIN/HR now read from DB settings
  table (DB > ENV > default), so dashboard/settings changes apply without
  restart. Sync cache refreshed on every save or delete.
- /api/me reports the live DB value for max_sites_per_user.

Admin improvements:
- Admin users bypass per-user rate limiting entirely (role=admin or ADMIN_EMAILS).
- Admin Overview now shows platform stats: registered users, new users (7d),
  total user sites, available tools.

Plugin cleanup:
- Appwrite and Directus plugins removed from the active registry (8 plugins
  now: WordPress, WooCommerce, WordPress Specialist, Gitea, n8n, Supabase,
  OpenPanel, Coolify). Plugin code is retained for future re-enabling.
- Settings page plugin visibility list updated to match.

Mobile onboarding:
- Stepper steps on narrow viewports stack vertically with correct full border
  and rounded corners on each step.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

core/endpoints/__init__.py

@@ -7,7 +7,7 @@ Each endpoint exposes only the tools relevant to its purpose.
 Endpoints:
     /mcp              - Admin endpoint (all tools, requires Master API Key)
     /mcp/wordpress    - WordPress tools only (92 tools)
-    /mcp/wordpress-advanced - WordPress Advanced tools (22 tools)
+    /mcp/wordpress-specialist - WordPress Specialist tools (companion-backed)
     /mcp/gitea        - Gitea tools only (55 tools)
     /mcp/project/{id} - Project-specific tools
 

core/endpoints/config.py

@@ -16,7 +16,7 @@ class EndpointType(Enum):
     SYSTEM = "system"  # Phase X.3 - System tools only
     WORDPRESS = "wordpress"
     WOOCOMMERCE = "woocommerce"
-    WORDPRESS_ADVANCED = "wordpress_advanced"
+    WORDPRESS_SPECIALIST = "wordpress_specialist"
     GITEA = "gitea"
     N8N = "n8n"
     SUPABASE = "supabase"  # Phase G
@@ -181,15 +181,28 @@ ENDPOINT_CONFIGS = {
         },
         max_tools=35,
     ),
-    # WordPress Advanced endpoint - advanced operations
-    EndpointType.WORDPRESS_ADVANCED: EndpointConfig(
-        path="/wordpress-advanced",
-        name="WordPress Advanced",
-        description="WordPress advanced operations (database, bulk, system)",
-        endpoint_type=EndpointType.WORDPRESS_ADVANCED,
-        plugin_types=["wordpress_advanced"],
+    # F.19.1 WordPress Specialist endpoint - companion-backed advanced
+    # management (plugins/themes/users/options/cron/maintenance). No
+    # Docker socket; only needs Airano MCP Bridge v2.11.0+ on the WP
+    # side. Currently 6 read-only tools; F.19.2 will expand the surface.
+    EndpointType.WORDPRESS_SPECIALIST: EndpointConfig(
+        path="/wordpress-specialist",
+        name="WordPress Specialist",
+        description="Specialist WordPress management (plugins, themes, users, options, cron) — companion-backed",
+        endpoint_type=EndpointType.WORDPRESS_SPECIALIST,
+        plugin_types=["wordpress_specialist"],
         require_master_key=False,
-        allowed_scopes={"admin"},  # Admin scope required
+        allowed_scopes={"read", "write", "admin"},
+        # Same blacklist as the basic wordpress endpoint — keep system
+        # tools off the per-plugin endpoint regardless of how the tool
+        # registry expands.
+        tool_blacklist={
+            "manage_api_keys_create",
+            "manage_api_keys_delete",
+            "manage_api_keys_rotate",
+            "oauth_register_client",
+            "oauth_revoke_client",
+        },
         max_tools=30,
     ),
     # Gitea endpoint - Git repository management

core/endpoints/factory.py

@@ -162,10 +162,13 @@ class MCPEndpointFactory:
         Returns:
             Plugin type or None for system tools
         """
-        # Check for wordpress_advanced first (before wordpress_)
-        # Tools are named: wordpress_advanced_wp_db_*, wordpress_advanced_bulk_*, wordpress_advanced_system_*
-        if tool_name.startswith("wordpress_advanced_"):
-            return "wordpress_advanced"
+        # Check the multi-word WordPress variant BEFORE the bare
+        # ``wordpress_`` prefix — tool names are
+        # ``wordpress_specialist_wp_plugin_list``,
+        # ``wordpress_create_post`` etc. (``wordpress_advanced`` was
+        # sunset in F.19.3.2-.3 / 2026-05-04.)
+        if tool_name.startswith("wordpress_specialist_"):
+            return "wordpress_specialist"
 
         if tool_name.startswith("wordpress_"):
             return "wordpress"

core/endpoints/registry.py

@@ -58,7 +58,7 @@ class EndpointRegistry:
         """
         Initialize the default set of endpoints.
 
-        Creates admin, wordpress, wordpress-advanced, and gitea endpoints.
+        Creates admin, wordpress, wordpress-specialist, and gitea endpoints.
         """
         if self._initialized:
             logger.warning("Endpoints already initialized")