feat(v3.13.0): settings live DB reads, remove Directus/Appwrite, admin stats

Settings fixes:
- MAX_SITES_PER_USER, USER_RATE_LIMIT_PER_MIN/HR now read from DB settings
  table (DB > ENV > default), so dashboard/settings changes apply without
  restart. Sync cache refreshed on every save or delete.
- /api/me reports the live DB value for max_sites_per_user.

Admin improvements:
- Admin users bypass per-user rate limiting entirely (role=admin or ADMIN_EMAILS).
- Admin Overview now shows platform stats: registered users, new users (7d),
  total user sites, available tools.

Plugin cleanup:
- Appwrite and Directus plugins removed from the active registry (8 plugins
  now: WordPress, WooCommerce, WordPress Specialist, Gitea, n8n, Supabase,
  OpenPanel, Coolify). Plugin code is retained for future re-enabling.
- Settings page plugin visibility list updated to match.

Mobile onboarding:
- Stepper steps on narrow viewports stack vertically with correct full border
  and rounded corners on each step.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

core/user_auth.py

@@ -35,6 +35,16 @@ _GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token"
 _GITHUB_USER_URL = "https://api.github.com/user"
 _GITHUB_EMAILS_URL = "https://api.github.com/user/emails"
 
+# api.github.com rejects requests without a User-Agent header and treats
+# requests that omit Accept/X-GitHub-Api-Version as forward-compatibility
+# violations on some endpoints (observed as 403 on /user and /user/emails
+# after httpx upgraded its default UA). Keep these explicit.
+_GITHUB_API_HEADERS = {
+    "Accept": "application/vnd.github+json",
+    "X-GitHub-Api-Version": "2022-11-28",
+    "User-Agent": "mcphub-oauth-client",
+}
+
 _GOOGLE_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth"
 _GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token"
 _GOOGLE_USERINFO_URL = "https://www.googleapis.com/oauth2/v3/userinfo"
@@ -258,19 +268,25 @@ class UserAuth:
             if not access_token:
                 raise ValueError(f"Failed to exchange GitHub code: {token_data}")
 
+            auth_headers = {
+                "Authorization": f"Bearer {access_token}",
+                **_GITHUB_API_HEADERS,
+            }
+
             # Fetch user info
-            user_resp = await client.get(
-                _GITHUB_USER_URL,
-                headers={"Authorization": f"Bearer {access_token}"},
-            )
+            user_resp = await client.get(_GITHUB_USER_URL, headers=auth_headers)
+            if user_resp.status_code != 200:
+                raise ValueError(f"GitHub /user returned {user_resp.status_code}: {user_resp.text}")
             user_data = user_resp.json()
+            if "id" not in user_data:
+                raise ValueError(f"GitHub /user response missing 'id' field: {user_data}")
 
             email = user_data.get("email")
             if not email:
                 # Fetch from /user/emails endpoint (private email fallback)
                 emails_resp = await client.get(
                     _GITHUB_EMAILS_URL,
-                    headers={"Authorization": f"Bearer {access_token}"},
+                    headers=auth_headers,
                 )
                 if emails_resp.status_code == 200:
                     emails = emails_resp.json()