release: v3.3.0 — platform hardening & admin unification (Track F.1–F.8)

Plugin visibility control, UI/UX fixes, unified admin panel,
database-backed settings, and security hardening.

Highlights:
- ENABLED_PLUGINS env var for plugin visibility (F.1)
- Admin designation via ADMIN_EMAILS (F.4a)
- Master key scope control (F.4b)
- Panel unification + settings from UI (F.4c)
- exec() removal, shell injection fix, bcrypt migration (F.8)
- 5 new test suites

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/admin_utils.py

@@ -0,0 +1,27 @@
+"""Admin utility functions for role determination.
+
+Centralizes admin email checking so it can be used in OAuth callback,
+dashboard auth, and future admin/user panel unification (F.5+).
+"""
+
+import os
+
+
+def is_admin_email(email: str | None) -> bool:
+    """Check if an email is in the ADMIN_EMAILS env var list.
+
+    Args:
+        email: Email address to check.
+
+    Returns:
+        True if email matches an admin email (case-insensitive).
+    """
+    if not email:
+        return False
+
+    admin_emails_raw = os.environ.get("ADMIN_EMAILS", "")
+    if not admin_emails_raw.strip():
+        return False
+
+    admin_emails = {e.strip().lower() for e in admin_emails_raw.split(",") if e.strip()}
+    return email.strip().lower() in admin_emails