release: v3.3.0 — platform hardening & admin unification (Track F.1–F.8)

Plugin visibility control, UI/UX fixes, unified admin panel,
database-backed settings, and security hardening.

Highlights:
- ENABLED_PLUGINS env var for plugin visibility (F.1)
- Admin designation via ADMIN_EMAILS (F.4a)
- Master key scope control (F.4b)
- Panel unification + settings from UI (F.4c)
- exec() removal, shell injection fix, bcrypt migration (F.8)
- 5 new test suites

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

env.example

@@ -27,6 +27,27 @@ ENCRYPTION_KEY=
 # Generate with: python -c "import secrets; print(secrets.token_hex(32))"
 DASHBOARD_SESSION_SECRET=
 
+# ============================================
+# PLUGIN VISIBILITY (Track F.1)
+# ============================================
+# Comma-separated list of plugins visible to public (OAuth) users.
+# Admin users always see all plugins regardless of this setting.
+# Default (if not set): wordpress,woocommerce,supabase
+# ENABLED_PLUGINS=wordpress,woocommerce,supabase
+
+# ============================================
+# ADMIN SYSTEM (Track F.4)
+# ============================================
+# Comma-separated list of emails that get admin role on OAuth login.
+# These users see the full admin dashboard (projects, API keys, health, etc.)
+# If not set, OAuth users only get the standard user dashboard.
+# ADMIN_EMAILS=admin@example.com,boss@company.com
+
+# Disable Master Key login to the web dashboard (default: false).
+# When true, only OAuth users (with admin email) can access admin dashboard.
+# Master Key still works for MCP endpoints — only dashboard login is affected.
+# DISABLE_MASTER_KEY_LOGIN=false
+
 # ============================================
 # WORDPRESS SITES
 # ============================================
@@ -118,6 +139,10 @@ WORDPRESS_SITE1_ALIAS=mysite
 #
 # Optional: direct postgres-meta URL for self-hosted when /pg/ is not via Kong:
 # SUPABASE_PROJECT1_META_URL=http://localhost:5555
+#
+# Optional: Basic Auth for postgres-meta when exposed via a public URL.
+# Format: username:password — not needed for internal Docker networks or Kong.
+# SUPABASE_PROJECT1_META_AUTH=admin:secretpassword
 
 # --- OpenPanel ---
 # OPENPANEL_INSTANCE1_URL=https://openpanel.example.com