feat(v3.13.0): settings live DB reads, remove Directus/Appwrite, admin stats

Settings fixes:
- MAX_SITES_PER_USER, USER_RATE_LIMIT_PER_MIN/HR now read from DB settings
  table (DB > ENV > default), so dashboard/settings changes apply without
  restart. Sync cache refreshed on every save or delete.
- /api/me reports the live DB value for max_sites_per_user.

Admin improvements:
- Admin users bypass per-user rate limiting entirely (role=admin or ADMIN_EMAILS).
- Admin Overview now shows platform stats: registered users, new users (7d),
  total user sites, available tools.

Plugin cleanup:
- Appwrite and Directus plugins removed from the active registry (8 plugins
  now: WordPress, WooCommerce, WordPress Specialist, Gitea, n8n, Supabase,
  OpenPanel, Coolify). Plugin code is retained for future re-enabling.
- Settings page plugin visibility list updated to match.

Mobile onboarding:
- Stepper steps on narrow viewports stack vertically with correct full border
  and rounded corners on each step.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_dashboard_keys_unified.py

@@ -1,4 +1,4 @@
-"""Tests for the unified /dashboard/keys page (F.7b session 2)."""
+"""Tests for the unified legacy /dashboard-legacy/keys page (F.7b session 2)."""
 
 from __future__ import annotations
 
@@ -55,27 +55,27 @@ def user_client(monkeypatch, user_row, patched_db):
 
 class TestUnifiedKeysUserView:
     def test_get_keys_page_returns_200(self, user_client):
-        r = user_client.get("/dashboard/keys")
+        r = user_client.get("/dashboard-legacy/keys")
         assert r.status_code == 200
         assert "API Key" in r.text or "کلید" in r.text
 
     def test_old_connect_redirects_301(self, user_client):
-        r = user_client.get("/dashboard/connect")
+        r = user_client.get("/dashboard-legacy/connect")
         assert r.status_code == 301
-        assert "/dashboard/keys" in r.headers["location"]
+        assert "/dashboard-legacy/keys" in r.headers["location"]
 
     def test_old_api_keys_redirects_301(self, user_client):
-        r = user_client.get("/dashboard/api-keys")
+        r = user_client.get("/dashboard-legacy/api-keys")
         assert r.status_code == 301
-        assert "/dashboard/keys" in r.headers["location"]
+        assert "/dashboard-legacy/keys" in r.headers["location"]
 
     def test_user_view_has_full_access_badge(self, user_client):
-        r = user_client.get("/dashboard/keys")
+        r = user_client.get("/dashboard-legacy/keys")
         assert r.status_code == 200
         # F.7c: No scope selector — shows "Full Access" badge instead
         assert "Full Access" in r.text or "دسترسی کامل" in r.text
 
     def test_user_view_shows_create_button(self, user_client):
-        r = user_client.get("/dashboard/keys")
+        r = user_client.get("/dashboard-legacy/keys")
         assert r.status_code == 200
         assert "Create" in r.text or "ایجاد" in r.text