release: v3.3.0 — platform hardening & admin unification (Track F.1–F.8)

Plugin visibility control, UI/UX fixes, unified admin panel,
database-backed settings, and security hardening.

Highlights:
- ENABLED_PLUGINS env var for plugin visibility (F.1)
- Admin designation via ADMIN_EMAILS (F.4a)
- Master key scope control (F.4b)
- Panel unification + settings from UI (F.4c)
- exec() removal, shell injection fix, bcrypt migration (F.8)
- 5 new test suites

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/user_endpoints.py

@@ -306,6 +306,17 @@ async def user_mcp_handler(request: Request) -> Response:
             status_code=403,
         )
 
+    # --- Plugin visibility check ---
+    from core.plugin_visibility import is_plugin_public
+
+    if not is_plugin_public(site["plugin_type"]):
+        return JSONResponse(
+            _jsonrpc_error(
+                None, -32600, f"Plugin '{site['plugin_type']}' is not currently available"
+            ),
+            status_code=403,
+        )
+
     # --- Parse JSON-RPC body ---
     try:
         body = await request.json()