feat(v3.13.0): settings live DB reads, remove Directus/Appwrite, admin stats

Settings fixes:
- MAX_SITES_PER_USER, USER_RATE_LIMIT_PER_MIN/HR now read from DB settings
  table (DB > ENV > default), so dashboard/settings changes apply without
  restart. Sync cache refreshed on every save or delete.
- /api/me reports the live DB value for max_sites_per_user.

Admin improvements:
- Admin users bypass per-user rate limiting entirely (role=admin or ADMIN_EMAILS).
- Admin Overview now shows platform stats: registered users, new users (7d),
  total user sites, available tools.

Plugin cleanup:
- Appwrite and Directus plugins removed from the active registry (8 plugins
  now: WordPress, WooCommerce, WordPress Specialist, Gitea, n8n, Supabase,
  OpenPanel, Coolify). Plugin code is retained for future re-enabling.
- Settings page plugin visibility list updated to match.

Mobile onboarding:
- Stepper steps on narrow viewports stack vertically with correct full border
  and rounded corners on each step.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

wordpress-plugin/airano-mcp-bridge-wporg/SUBMISSION_REPLY.md

@@ -0,0 +1,95 @@
+# Reply to wp.org review email — paste into the email thread
+
+Keep this short and direct. wp.org explicitly asks reviewers to skim, not read essays.
+
+---
+
+## Subject line (current round — class-prefix fix)
+
+Re: It's time to move forward with the plugin review "airano" — airano-mcp-bridge
+
+(Reply in the existing thread; don't open a new one.)
+
+---
+
+## Body — paste this for the SECOND review (class prefix fix)
+
+```
+Hi,
+
+Thanks. Addressed in v2.10.3:
+
+- Main class renamed from generic `SEO_API_Bridge` to `Airano_MCP_Bridge`
+  to use the plugin-specific prefix (your "unique prefixes" guideline).
+  All other elements already used the `airano` prefix as you noted.
+  This is an internal refactor — the class is only instantiated from the
+  file's bootstrap line and is never referenced by callers, so there's no
+  public-API impact.
+
+Updated zip uploaded via "Add your plugin" while logged in as airano.
+
+Thanks,
+airano
+```
+
+### Reply for the FIRST review (already sent — kept here for reference)
+
+This was the response to the initial pre-review email about ownership
++ media.php/permission_callback. Already sent.
+
+```
+Hi,
+
+Thanks for the review. Two notes on the requested items:
+
+1) Ownership / domain verification
+
+The plugin's URI is https://mcp.example.com (the public site for
+MCP Hub, the project this companion plugin pairs with). I publish to
+both mcp.example.com and example.com; my account on
+wordpress.org is "airano".
+
+I've published the requested DNS TXT record at the plugin's domain:
+
+  Host:   mcp.example.com
+  Type:   TXT
+  Value:  wordpressorg-airano-verification
+
+Please verify with `dig TXT mcp.example.com +short` (the value
+should appear within the TTL).
+
+I have also already published https://wordpress.org/plugins/airano-mcp-seo-bridge/
+under the same airano account. That plugin is the SEO-only ancestor of
+this one. Once airano-mcp-bridge is approved I will release a final
+update there pointing users to the new slug.
+
+2) Code review items
+
+Both code points have been addressed in v2.10.2:
+
+- The redundant `wp-admin/includes/media.php` requires inside
+  /upload-chunk and /upload-and-attach are removed. Those callbacks
+  only use helpers from file.php (wp_tempnam, wp_handle_sideload) and
+  image.php (wp_generate_attachment_metadata).
+
+- /upload-and-attach now has its own permission_callback,
+  `require_upload_and_attach_capability`, which enforces
+  `current_user_can('edit_post', $attach_to_post)` at the route gate
+  when attach_to_post is supplied (no longer hidden inside the
+  callback body), and rejects set_featured without a target post.
+
+I've uploaded the corrected v2.10.2 zip via "Add your plugin" while
+logged in as airano.
+
+Happy to make further changes if anything else turns up on a closer read.
+
+Thanks,
+airano
+```
+
+---
+
+## Before sending
+
+- [ ] You've uploaded `airano-mcp-bridge.zip` (v2.10.3) via the same "Add your plugin" page while logged in as `airano`.
+- [ ] You're replying *in the existing thread* with the body shown above.