feat(v3.13.0): settings live DB reads, remove Directus/Appwrite, admin stats

Settings fixes:
- MAX_SITES_PER_USER, USER_RATE_LIMIT_PER_MIN/HR now read from DB settings
  table (DB > ENV > default), so dashboard/settings changes apply without
  restart. Sync cache refreshed on every save or delete.
- /api/me reports the live DB value for max_sites_per_user.

Admin improvements:
- Admin users bypass per-user rate limiting entirely (role=admin or ADMIN_EMAILS).
- Admin Overview now shows platform stats: registered users, new users (7d),
  total user sites, available tools.

Plugin cleanup:
- Appwrite and Directus plugins removed from the active registry (8 plugins
  now: WordPress, WooCommerce, WordPress Specialist, Gitea, n8n, Supabase,
  OpenPanel, Coolify). Plugin code is retained for future re-enabling.
- Settings page plugin visibility list updated to match.

Mobile onboarding:
- Stepper steps on narrow viewports stack vertically with correct full border
  and rounded corners on each step.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

core/oauth/server.py

@@ -114,8 +114,13 @@ class OAuthServer:
                 error_description="Only S256 code_challenge_method is supported (OAuth 2.1)",
             )
 
-        # Validate scope
-        requested_scopes = scope.split() if scope else ["read", "write", "admin"]
+        # Validate scope. F.19.2.2: default to every tier explicitly so
+        # an OAuth client without a scope hint gets the same surface as a
+        # dashboard-issued user key. The binding narrowing is per-site
+        # (intersection with the site's tool_scope preset).
+        requested_scopes = (
+            scope.split() if scope else ["read", "editor", "settings", "install", "write", "admin"]
+        )
         for s in requested_scopes:
             if s not in client.allowed_scopes:
                 raise OAuthError(