release: v3.3.0 — platform hardening & admin unification (Track F.1–F.8)

Plugin visibility control, UI/UX fixes, unified admin panel,
database-backed settings, and security hardening.

Highlights:
- ENABLED_PLUGINS env var for plugin visibility (F.1)
- Admin designation via ADMIN_EMAILS (F.4a)
- Master key scope control (F.4b)
- Panel unification + settings from UI (F.4c)
- exec() removal, shell injection fix, bcrypt migration (F.8)
- 5 new test suites

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

plugins/supabase/plugin.py

@@ -59,6 +59,7 @@ class SupabasePlugin(BasePlugin):
                 - service_role_key: Admin API key (bypasses RLS). Required.
                 - anon_key: Public API key (RLS protected). Optional.
                 - meta_url: Direct postgres-meta URL. Optional.
+                - meta_auth: Basic Auth for postgres-meta (username:password). Optional.
             project_id: Optional project ID (auto-generated if not provided)
         """
         super().__init__(config, project_id=project_id)
@@ -69,6 +70,7 @@ class SupabasePlugin(BasePlugin):
             anon_key=config.get("anon_key", ""),
             service_role_key=config["service_role_key"],
             meta_url=config.get("meta_url"),
+            meta_auth=config.get("meta_auth"),
         )
 
     @staticmethod