feat(v3.13.0): settings live DB reads, remove Directus/Appwrite, admin stats

Settings fixes:
- MAX_SITES_PER_USER, USER_RATE_LIMIT_PER_MIN/HR now read from DB settings
  table (DB > ENV > default), so dashboard/settings changes apply without
  restart. Sync cache refreshed on every save or delete.
- /api/me reports the live DB value for max_sites_per_user.

Admin improvements:
- Admin users bypass per-user rate limiting entirely (role=admin or ADMIN_EMAILS).
- Admin Overview now shows platform stats: registered users, new users (7d),
  total user sites, available tools.

Plugin cleanup:
- Appwrite and Directus plugins removed from the active registry (8 plugins
  now: WordPress, WooCommerce, WordPress Specialist, Gitea, n8n, Supabase,
  OpenPanel, Coolify). Plugin code is retained for future re-enabling.
- Settings page plugin visibility list updated to match.

Mobile onboarding:
- Stepper steps on narrow viewports stack vertically with correct full border
  and rounded corners on each step.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

wordpress-plugin/airano-mcp-bridge-wporg/README.md

@@ -0,0 +1,80 @@
+# airano-mcp-bridge — WordPress.org submission package
+
+This folder is the **wp.org-bound** version of the companion plugin. It is
+deliberately the small surface (≈15 routes — SEO, media uploads, capability
+probe, cache/transient/site-health, audit-hook), **not** the full v2.18.x
+internal build.
+
+The internal build at [../airano-mcp-bridge/](../airano-mcp-bridge) carries
+the admin namespace (plugins/themes/files/db/elementor/etc.) which is too
+broad for wp.org's review bar and stays out of the public release.
+
+## Layout
+
+```
+airano-mcp-bridge-wporg/
+├── airano-mcp-bridge/        ← what goes in the zip
+│   ├── airano-mcp-bridge.php
+│   ├── readme.txt
+│   └── README.md
+├── tests/
+│   ├── check.sh              ← static checks (headers, escaping, routes, etc.)
+│   └── test_permission_callback.php   ← unit test for the new gate
+└── airano-mcp-bridge.zip     ← ready-to-upload bundle (built from the folder)
+```
+
+## Pre-submission checks
+
+```bash
+# 1. Static / heuristic checks (no WordPress runtime required)
+bash wordpress-plugin/airano-mcp-bridge-wporg/tests/check.sh
+
+# 2. Unit tests on the new permission_callback (PHP-only, no WP bootstrap)
+php wordpress-plugin/airano-mcp-bridge-wporg/tests/test_permission_callback.php
+```
+
+Both must exit 0 before zipping or uploading.
+
+## Building the zip
+
+```bash
+python - <<'PY'
+import zipfile, os
+src = "wordpress-plugin/airano-mcp-bridge-wporg/airano-mcp-bridge"
+dst = "wordpress-plugin/airano-mcp-bridge-wporg/airano-mcp-bridge.zip"
+if os.path.exists(dst): os.remove(dst)
+with zipfile.ZipFile(dst, "w", zipfile.ZIP_DEFLATED, compresslevel=9) as z:
+    for root, _, files in os.walk(src):
+        for f in files:
+            full = os.path.join(root, f)
+            arc  = os.path.relpath(full, "wordpress-plugin/airano-mcp-bridge-wporg").replace(os.sep, "/")
+            z.write(full, arc)
+print("built:", dst, os.path.getsize(dst), "bytes")
+PY
+```
+
+## Reply to the wp.org review email
+
+Use the message in [SUBMISSION_REPLY.md](SUBMISSION_REPLY.md). Keep it
+short — the wp.org guidance is "be brief and direct".
+
+## What the v2.10.2 release fixes (vs the v2.10.1 they reviewed)
+
+1. **Direct core file include**
+   `wp-admin/includes/media.php` was loaded inside the `/upload-chunk` and
+   `/upload-and-attach` REST callbacks but never used (the code only calls
+   helpers from `file.php` and `image.php`). The redundant `require_once`
+   lines are removed.
+
+2. **`/upload-and-attach` permission gate**
+   The route now uses a dedicated `require_upload_and_attach_capability`
+   method that runs `current_user_can('edit_post', $attach_to_post)` at
+   the route gate when `attach_to_post` is supplied. The check is no
+   longer hidden inside the callback body, so static analysis can see it.
+   The method also rejects `set_featured` without a target post.
+
+3. **Ownership verification**
+   DNS TXT record `wordpressorg-airano-verification` is published at
+   `mcp.example.com`, which is also the `Plugin URI`. This pairs the
+   submission with the domain the plugin advertises and satisfies the
+   wp.org review request for a non-gmail.com proof of identity.