fix: BUG-7, BUG-10, BUG-11, BUG-12 — remaining bug fixes

- BUG-12: ENCRYPTION_KEY validation now exits with sys.exit(1) on invalid key
- BUG-11: WP Advanced health check adds authenticated fallback with auth_valid
- BUG-7: Catch-all GET route serves styled 404 HTML instead of plain text
- BUG-10: Recent Activity fetches extra entries before filtering, fixes None project

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

core/health.py

@@ -553,12 +553,36 @@ class HealthMonitor:
             plugin_instance = plugin_registry.create_instance(plugin_type, site_id, config_dict)
             return await plugin_instance.health_check()
         except Exception as e:
-            logger.debug(
+            logger.warning(
                 f"Could not create plugin instance for {project_id}, "
-                f"falling back to basic HTTP check: {e}"
+                f"falling back to authenticated HTTP check: {e}"
             )
 
-        # Fallback: basic HTTP check if plugin instantiation fails
+        # Fallback: authenticated health check for WordPress-based plugins
+        if plugin_type in ("wordpress", "wordpress_advanced", "woocommerce"):
+            try:
+                import aiohttp
+
+                auth = aiohttp.BasicAuth(
+                    config.username or "",
+                    config.app_password or "",
+                )
+                async with aiohttp.ClientSession(auth=auth) as session:
+                    async with session.get(
+                        f"{config.url}/wp-json/wp/v2/users/me",
+                        timeout=aiohttp.ClientTimeout(total=10),
+                        ssl=False,
+                    ) as resp:
+                        auth_valid = resp.status == 200
+                basic_result = await self._basic_http_health_check(config.url, project_id)
+                basic_result["auth_valid"] = auth_valid
+                if not auth_valid:
+                    basic_result["auth_warning"] = "Site accessible but credentials may be invalid"
+                return basic_result
+            except Exception:
+                pass
+
+        # Last resort: basic HTTP check
         return await self._basic_http_health_check(config.url, project_id)
 
     async def _basic_http_health_check(self, url: str | None, project_id: str) -> dict[str, Any]: