release: v3.3.0 — platform hardening & admin unification (Track F.1–F.8)

Plugin visibility control, UI/UX fixes, unified admin panel,
database-backed settings, and security hardening.

Highlights:
- ENABLED_PLUGINS env var for plugin visibility (F.1)
- Admin designation via ADMIN_EMAILS (F.4a)
- Master key scope control (F.4b)
- Panel unification + settings from UI (F.4c)
- exec() removal, shell injection fix, bcrypt migration (F.8)
- 5 new test suites

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/user_keys.py

@@ -56,7 +56,7 @@ class UserKeyManager:
         self,
         user_id: str,
         name: str,
-        scopes: str = "read write",
+        scopes: str = "read write admin",
         expires_in_days: int | None = None,
     ) -> dict[str, Any]:
         """Create a new API key for a user.
@@ -64,7 +64,7 @@ class UserKeyManager:
         Args:
             user_id: Owner's UUID.
             name: Human label (e.g. "Claude Desktop").
-            scopes: Ignored — always "read write" (full access).
+            scopes: Access scopes (default: "read write admin" for full access).
             expires_in_days: Optional expiry in days from now. None = never.
 
         Returns:
@@ -73,9 +73,6 @@ class UserKeyManager:
         """
         from core.database import get_database
 
-        # All user API keys get full access — scopes param is ignored
-        scopes = "read write"
-
         raw_key = KEY_PREFIX_TAG + secrets.token_urlsafe(KEY_RANDOM_BYTES)
         key_prefix = raw_key[len(KEY_PREFIX_TAG) : len(KEY_PREFIX_TAG) + KEY_PREFIX_LEN]
         key_hash = bcrypt.hashpw(raw_key.encode(), bcrypt.gensalt()).decode()