release: v3.3.0 — platform hardening & admin unification (Track F.1–F.8)

Plugin visibility control, UI/UX fixes, unified admin panel,
database-backed settings, and security hardening.

Highlights:
- ENABLED_PLUGINS env var for plugin visibility (F.1)
- Admin designation via ADMIN_EMAILS (F.4a)
- Master key scope control (F.4b)
- Panel unification + settings from UI (F.4c)
- exec() removal, shell injection fix, bcrypt migration (F.8)
- 5 new test suites

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/oauth/schemas.py

@@ -18,9 +18,9 @@ class OAuthClient(BaseModel):
         default=["authorization_code", "refresh_token"], description="Allowed grant types"
     )
     response_types: list[str] = Field(default=["code"], description="Allowed response types")
-    scope: str = Field(default="read", description="Default scope for this client")
+    scope: str = Field(default="read write admin", description="Default scope for this client")
     allowed_scopes: list[str] = Field(
-        default=["read", "write"], description="All scopes this client can request"
+        default=["read", "write", "admin"], description="All scopes this client can request"
     )
     token_endpoint_auth_method: str = Field(
         default="client_secret_post", description="Token endpoint authentication method"