fix: 15 bug fixes for v3.1.0 dashboard and Track E features

Bug fixes (ordered by priority):
- BUG-14 (P1): Fix ImportError in per-user MCP endpoint
- BUG-8 (P2): Raise clear error when PUBLIC_URL missing for OAuth
- BUG-12 (P3): Validate ENCRYPTION_KEY at startup
- BUG-13 (P4): Handle stale JWT gracefully on site creation
- BUG-11 (P5): Add auth validation to WordPress health checks
- BUG-15 (P6): Fix copy button showing Python repr (dict method shadow)
- BUG-1 (P7): Dynamic version from pyproject.toml instead of hardcoded
- BUG-5 (P8): Fix server mode default (sse → streamable-http)
- BUG-9 (P9): Plugin-specific example tools in endpoint instructions
- BUG-4 (P10): Fix settings page sidebar RBAC (session type mismatch)
- BUG-6 (P11): Show real plugin descriptions instead of 'No description'
- BUG-2 (P12): Remove stale 'phase: X.3' from system info
- BUG-10 (P13): Guard timestamps against None in Recent Activity
- BUG-3 (P14): Guard timestamps against None in audit logs
- BUG-7 (P15): Styled 404 page instead of plain text

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

plugins/wordpress/client.py

@@ -540,7 +540,7 @@ class WordPressClient:
                 async with session.get(f"{self.site_url}/wp-json") as response:
                     if response.status == 200:
                         data = await response.json()
-                        return {
+                        result = {
                             "healthy": True,
                             "accessible": True,
                             "name": data.get("name", "Unknown"),
@@ -549,6 +549,18 @@ class WordPressClient:
                             "routes": len(data.get("routes", {})),
                         }
 
+                        # Test authentication with an authenticated request
+                        try:
+                            await self.get("users/me")
+                            result["auth_valid"] = True
+                        except Exception:
+                            result["auth_valid"] = False
+                            result["auth_warning"] = (
+                                "Site accessible but credentials may be invalid"
+                            )
+
+                        return result
+
                     # Detect REST API disabled (common with security plugins)
                     if response.status in (403, 404):
                         return {

plugins/wordpress_advanced/plugin.py

@@ -132,6 +132,15 @@ class WordPressAdvancedPlugin(BasePlugin):
             except Exception as e:
                 self.logger.warning(f"REST API check failed: {e}")
 
+            # Test authentication with an authenticated request
+            auth_valid = False
+            if rest_api_available:
+                try:
+                    await self.client.get("users/me")
+                    auth_valid = True
+                except Exception:
+                    pass
+
             # Test WP-CLI access (optional — only needed for database/system tools)
             wp_cli_available = False
             try:
@@ -140,16 +149,20 @@ class WordPressAdvancedPlugin(BasePlugin):
             except Exception:
                 pass
 
-            return {
+            result = {
                 "healthy": rest_api_available,
                 "wp_cli_available": wp_cli_available,
                 "rest_api_available": rest_api_available,
+                "auth_valid": auth_valid,
                 "features": {
                     "database_operations": wp_cli_available,
                     "bulk_operations": rest_api_available,
                     "system_operations": wp_cli_available,
                 },
             }
+            if not auth_valid and rest_api_available:
+                result["auth_warning"] = "Site accessible but credentials may be invalid"
+            return result
         except Exception as e:
             return {
                 "healthy": False,