feat(v3.12.0): media pipeline, AI image generation, capability probe, companion v2.9.0

Three-month batch sync from internal repo (~80 commits) covering Tracks F.5a, F.7e, F.8, F.17, F.18, F.X.

WordPress media pipeline
- Pillow-based optimization, AI image generation (OpenAI / Stability / Replicate / Google Nano Banana / OpenRouter), chunked + resumable uploads, bulk delete/reassign, idempotent retries.

Capability discovery (F.7e)
- Per-site credential probe + adapters for WordPress / WooCommerce / Gitea, tier-fit unions granted ∪ roles, capability badge UI with HTMX partial re-check, install hint in every companion-unreachable error.

Companion plugin overhaul
- Renamed wordpress-plugin/airano-mcp-seo-bridge → wordpress-plugin/airano-mcp-bridge.
- Eight new endpoints: /capabilities, /bulk-meta, /export, /cache-purge, /transient-flush, /site-health, /audit-hook, /upload-and-attach.
- wp.org Plugin Check pass: i18n, WP_Filesystem, scheme allowlist on audit-hook URL.

Other
- Gitea ergonomics (F.17): batch files, tree, search, compare, releases, fork.
- Opportunistic bcrypt upgrade for legacy SHA-256 admin keys (F.8).
- n8n refactor: structured errors, capability probe, missing tools backfilled.
- Idempotency-Key dedup for AI media upload retries; WP client fast-fails on unreachable sites.

Docs
- README + CLAUDE.md drop the fixed "633 tools" claim. The total grows with each release; per-plugin approximations + dashboard-surfaced counts replace it.
- Tools/Tests badges removed in favour of "Plugins: 10".

Deployment
- PyPI mirror chain, optional BUILD_HTTP_PROXY, Alpine→Yandex apk mirror, Debian-slim Plan-B Dockerfile, mirror.gcr.io variant.

CI
- Black + Ruff clean on Python 3.12; pytest tests/ green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

plugins/n8n/plugin.py

@@ -18,8 +18,8 @@ class N8nPlugin(BasePlugin):
     n8n Automation Plugin - Comprehensive workflow management.
 
     Provides complete n8n management capabilities including:
-    - Workflow management (CRUD, activate, deactivate, execute)
-    - Execution monitoring (list, get, delete, retry, wait)
+    - Workflow management (CRUD, activate, deactivate, execute, transfer)
+    - Execution monitoring (list, get, delete, retry, wait, project filter)
     - Credential management (get, create, delete, schema, transfer)
     - Tag management (CRUD, bulk delete)
     - User management (CRUD, roles)
@@ -27,7 +27,7 @@ class N8nPlugin(BasePlugin):
     - Variable management (CRUD, bulk set) - Enterprise/Pro
     - System operations (audit, source control, health)
 
-    Total: 56 tools
+    Total: 57 tools
     """
 
     @staticmethod
@@ -69,7 +69,7 @@ class N8nPlugin(BasePlugin):
         specs = []
 
         # Collect specifications from all handlers
-        specs.extend(handlers.workflows.get_tool_specifications())  # 14 tools
+        specs.extend(handlers.workflows.get_tool_specifications())  # 15 tools
         specs.extend(handlers.executions.get_tool_specifications())  # 8 tools
         specs.extend(handlers.credentials.get_tool_specifications())  # 5 tools
         specs.extend(handlers.tags.get_tool_specifications())  # 6 tools
@@ -118,24 +118,62 @@ class N8nPlugin(BasePlugin):
         # Method not found in any handler
         raise AttributeError(f"'{self.__class__.__name__}' object has no attribute '{name}'")
 
+    async def probe_credential_capabilities(self) -> dict[str, Any]:
+        """F.7e — probe the n8n API key's effective permissions.
+
+        Calls ``GET /api/v1/user`` which returns the current user's
+        ``globalRole`` (and ``globalScopes`` on enterprise). If the key
+        is invalid or the endpoint is unreachable we return a graceful
+        fallback so the dashboard can still render a status badge.
+        """
+        from plugins.n8n.client import N8nAuthError, N8nConnectionError
+
+        try:
+            user = await self.client.get_current_user()
+        except N8nAuthError as exc:
+            return {
+                "probe_available": False,
+                "granted": [],
+                "source": "n8n_api",
+                "reason": f"auth_failed: {exc}",
+            }
+        except (N8nConnectionError, Exception) as exc:  # noqa: BLE001
+            return {
+                "probe_available": False,
+                "granted": [],
+                "source": "n8n_api",
+                "reason": f"probe_failed: {exc}",
+            }
+
+        role_name = ""
+        role_obj = user.get("role") or user.get("globalRole") or ""
+        if isinstance(role_obj, dict):
+            role_name = role_obj.get("name", "")
+        elif isinstance(role_obj, str):
+            role_name = role_obj
+        scopes = user.get("globalScopes") or []
+
+        return {
+            "probe_available": True,
+            "granted": sorted(scopes) if scopes else [role_name],
+            "source": "n8n_api",
+            "role": role_name,
+            "email": user.get("email", ""),
+        }
+
     async def check_health(self) -> dict[str, Any]:
-        """
-        Check if n8n instance is accessible (internal use).
-
-        Note: This is named check_health to avoid shadowing the handler's
-        health_check function which is exposed as an MCP tool.
-
-        Returns:
-            Dict containing health check result
-        """
+        """Check if n8n instance is accessible (internal use)."""
         try:
             result = await self.client.health_check()
             return {
                 "healthy": result.get("healthy", False),
-                "message": f"n8n instance at {self.client.site_url} is {'accessible' if result.get('healthy') else 'not accessible'}",
+                "message": (
+                    f"n8n instance at {self.client.site_url} is "
+                    f"{'accessible' if result.get('healthy') else 'not accessible'}"
+                ),
             }
         except Exception as e:
-            return {"healthy": False, "message": f"n8n health check failed: {str(e)}"}
+            return {"healthy": False, "message": f"n8n health check failed: {e}"}
 
     async def health_check(self, **kwargs) -> str:
         """