feat(F.7+F.17): v3.11.0 — Coolify plugin (67 tools) + tool access overhaul

Catch-up sync spanning v3.7.0 → v3.11.0 of the internal repo.

Platform
- Total tools: 565 → 633 (+68) across 10 plugins (Coolify added)
- Tests: 481 → 828 passing

New plugin: Coolify (67 tools, Track F.17)
- Applications (17): CRUD, lifecycle, logs, env vars
- Deployments (5): list/get/cancel/deploy, app history
- Servers (8): CRUD, resources, domains, validation
- Projects (8), Databases (16, 6 DB types + backups), Services (13)

Tool access system (Track F.7 → F.7d)
- Scope → category mapping with per-tool `category` + `sensitivity`
- Schema v7: `site_tool_toggles(site_id)` + `sites.tool_scope` column
- Schema v8: per-site API keys (`api_keys.site_id`)
- Plugin-specific access-level presets (WP / WC / Gitea / OpenPanel /
  Coolify 5-tier)
- Credential-requirement notice tailored per plugin and tier
- Admin Tools count card on service page
- Dropped redundant `write` tier on WP / WP Advanced / WooCommerce
  (admin-scope tool count = 0 → identical to admin tier)

Dashboard
- Unified site manage page (Connection / Tool Access / Connect)
- /dashboard/keys unified (was /api-keys and /connect)
- CSRF interceptor via meta-tag; removed conflicting cookie reader
- Tailwind: pre-built CSS (scripts/build-css.sh) replaces CDN

Docs
- README / DOCKER_README / CLAUDE updated to 633 tools / 10 plugins
- CHANGELOG entries for v3.7.0 → v3.11.0
- FastMCP compatibility note updated to 3.x (post-v3.5 upgrade)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/templates/dashboard/oauth-clients/list.html

@@ -220,24 +220,14 @@ https://claude.com/api/mcp/auth_callback</textarea>
             </div>
 
             <div>
-                <label class="block text-sm text-gray-500 dark:text-gray-400 mb-1">{% if lang == 'fa' %}دامنه‌ها{% else %}Scopes{% endif %}</label>
-                <div class="flex flex-wrap gap-2">
-                    <label class="flex items-center gap-2">
-                        <input type="checkbox" name="scopes" value="read" checked class="rounded bg-gray-700 border-gray-600 text-primary-500">
-                        <span class="text-sm text-gray-700 dark:text-gray-300">read</span>
-                    </label>
-                    <label class="flex items-center gap-2">
-                        <input type="checkbox" name="scopes" value="write" checked class="rounded bg-gray-700 border-gray-600 text-primary-500">
-                        <span class="text-sm text-gray-700 dark:text-gray-300">write</span>
-                    </label>
-                    <label class="flex items-center gap-2">
-                        <input type="checkbox" name="scopes" value="admin" checked class="rounded bg-gray-700 border-gray-600 text-primary-500">
-                        <span class="text-sm text-gray-700 dark:text-gray-300">admin</span>
-                    </label>
+                <div class="flex items-center gap-3">
+                    <span class="px-3 py-1 bg-green-100 dark:bg-green-500/20 text-green-700 dark:text-green-400 text-sm font-medium rounded-lg">
+                        {% if lang == 'fa' %}دسترسی کامل{% else %}Full Access{% endif %}
+                    </span>
+                    <p class="text-xs text-gray-500 dark:text-gray-400">
+                        {% if lang == 'fa' %}دسترسی ابزار در تنظیمات هر سایت کنترل می‌شود.{% else %}Tool access is controlled per-site in Site Settings.{% endif %}
+                    </p>
                 </div>
-                <p class="text-xs text-gray-500 mt-1">
-                    {% if lang == 'fa' %}admin: دسترسی کامل به همه عملیات{% else %}admin: Full access to all operations{% endif %}
-                </p>
             </div>
 
             <div class="flex justify-end gap-3 pt-4">
@@ -426,10 +416,8 @@ https://claude.com/api/mcp/auth_callback</textarea>
         e.preventDefault();
 
         var formData = new FormData(this);
-        var scopes = [];
-        document.querySelectorAll('input[name="scopes"]:checked').forEach(function(cb) {
-            scopes.push(cb.value);
-        });
+        // F.7c: All clients get full scope — tool access controlled per-site
+        var scopes = ['read', 'write', 'admin'];
 
         // Parse redirect URIs (one per line)
         var redirectUrisText = formData.get('redirect_uris') || '';