feat(v3.12.0): media pipeline, AI image generation, capability probe, companion v2.9.0

Three-month batch sync from internal repo (~80 commits) covering Tracks F.5a, F.7e, F.8, F.17, F.18, F.X.

WordPress media pipeline
- Pillow-based optimization, AI image generation (OpenAI / Stability / Replicate / Google Nano Banana / OpenRouter), chunked + resumable uploads, bulk delete/reassign, idempotent retries.

Capability discovery (F.7e)
- Per-site credential probe + adapters for WordPress / WooCommerce / Gitea, tier-fit unions granted ∪ roles, capability badge UI with HTMX partial re-check, install hint in every companion-unreachable error.

Companion plugin overhaul
- Renamed wordpress-plugin/airano-mcp-seo-bridge → wordpress-plugin/airano-mcp-bridge.
- Eight new endpoints: /capabilities, /bulk-meta, /export, /cache-purge, /transient-flush, /site-health, /audit-hook, /upload-and-attach.
- wp.org Plugin Check pass: i18n, WP_Filesystem, scheme allowlist on audit-hook URL.

Other
- Gitea ergonomics (F.17): batch files, tree, search, compare, releases, fork.
- Opportunistic bcrypt upgrade for legacy SHA-256 admin keys (F.8).
- n8n refactor: structured errors, capability probe, missing tools backfilled.
- Idempotency-Key dedup for AI media upload retries; WP client fast-fails on unreachable sites.

Docs
- README + CLAUDE.md drop the fixed "633 tools" claim. The total grows with each release; per-plugin approximations + dashboard-surfaced counts replace it.
- Tools/Tests badges removed in favour of "Plugins: 10".

Deployment
- PyPI mirror chain, optional BUILD_HTTP_PROXY, Alpine→Yandex apk mirror, Debian-slim Plan-B Dockerfile, mirror.gcr.io variant.

CI
- Black + Ruff clean on Python 3.12; pytest tests/ green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/test_database.py

@@ -604,6 +604,103 @@ class TestSiteToolToggles:
         assert await db.get_site_tool_scope("does-not-exist") == "admin"
 
 
+class TestSiteProviderKeys:
+    """F.5a.9.x: per-site AI provider key CRUD + cascade on site delete."""
+
+    @pytest.mark.unit
+    async def test_empty_list_by_default(self, db, site_row):
+        assert await db.list_site_provider_keys(site_row["id"]) == []
+
+    @pytest.mark.unit
+    async def test_upsert_and_get(self, db, site_row):
+        row = await db.upsert_site_provider_key(site_row["id"], "openai", b"ciphertext-bytes")
+        assert row["provider"] == "openai"
+        assert row["site_id"] == site_row["id"]
+
+        fetched = await db.get_site_provider_key(site_row["id"], "openai")
+        assert fetched is not None
+        assert fetched["key_ciphertext"] == b"ciphertext-bytes"
+
+    @pytest.mark.unit
+    async def test_upsert_replaces_existing(self, db, site_row):
+        await db.upsert_site_provider_key(site_row["id"], "openai", b"first")
+        await db.upsert_site_provider_key(site_row["id"], "openai", b"second")
+
+        fetched = await db.get_site_provider_key(site_row["id"], "openai")
+        assert fetched is not None
+        assert fetched["key_ciphertext"] == b"second"
+
+    @pytest.mark.unit
+    async def test_list_orders_by_provider(self, db, site_row):
+        await db.upsert_site_provider_key(site_row["id"], "stability", b"s")
+        await db.upsert_site_provider_key(site_row["id"], "openai", b"o")
+        await db.upsert_site_provider_key(site_row["id"], "replicate", b"r")
+
+        rows = await db.list_site_provider_keys(site_row["id"])
+        providers = [r["provider"] for r in rows]
+        assert providers == ["openai", "replicate", "stability"]
+        # list_* excludes ciphertext
+        assert all("key_ciphertext" not in r for r in rows)
+
+    @pytest.mark.unit
+    async def test_delete(self, db, site_row):
+        await db.upsert_site_provider_key(site_row["id"], "openai", b"x")
+        deleted = await db.delete_site_provider_key(site_row["id"], "openai")
+        assert deleted is True
+        assert await db.get_site_provider_key(site_row["id"], "openai") is None
+
+    @pytest.mark.unit
+    async def test_delete_missing_returns_false(self, db, site_row):
+        assert await db.delete_site_provider_key(site_row["id"], "openai") is False
+
+    @pytest.mark.unit
+    async def test_touch_updates_last_used(self, db, site_row):
+        await db.upsert_site_provider_key(site_row["id"], "openai", b"x")
+        fetched_before = await db.get_site_provider_key(site_row["id"], "openai")
+        assert fetched_before is not None
+        assert fetched_before["last_used"] is None
+
+        await db.touch_site_provider_key(site_row["id"], "openai")
+        fetched_after = await db.get_site_provider_key(site_row["id"], "openai")
+        assert fetched_after is not None
+        assert fetched_after["last_used"] is not None
+
+    @pytest.mark.unit
+    async def test_cascade_delete_on_site(self, db, user_row, site_row):
+        await db.upsert_site_provider_key(site_row["id"], "openai", b"x")
+        await db.delete_site(site_row["id"], user_row["id"])
+
+        rows = await db.fetchall(
+            "SELECT * FROM site_provider_keys WHERE site_id = ?",
+            (site_row["id"],),
+        )
+        assert rows == []
+
+    @pytest.mark.unit
+    async def test_two_sites_keys_are_isolated(self, db, user_row):
+        s1 = await db.create_site(
+            user_id=user_row["id"],
+            plugin_type="wordpress",
+            alias="a",
+            url="https://a.example.com",
+            credentials=b"c1",
+        )
+        s2 = await db.create_site(
+            user_id=user_row["id"],
+            plugin_type="woocommerce",
+            alias="b",
+            url="https://b.example.com",
+            credentials=b"c2",
+        )
+        await db.upsert_site_provider_key(s1["id"], "openai", b"A")
+        await db.upsert_site_provider_key(s2["id"], "openai", b"B")
+
+        got_a = await db.get_site_provider_key(s1["id"], "openai")
+        got_b = await db.get_site_provider_key(s2["id"], "openai")
+        assert got_a is not None and got_a["key_ciphertext"] == b"A"
+        assert got_b is not None and got_b["key_ciphertext"] == b"B"
+
+
 class TestModuleHelpers:
     """Test get_database() and initialize_database() helpers."""