feat(v3.12.0): media pipeline, AI image generation, capability probe, companion v2.9.0

Three-month batch sync from internal repo (~80 commits) covering Tracks F.5a, F.7e, F.8, F.17, F.18, F.X.

WordPress media pipeline
- Pillow-based optimization, AI image generation (OpenAI / Stability / Replicate / Google Nano Banana / OpenRouter), chunked + resumable uploads, bulk delete/reassign, idempotent retries.

Capability discovery (F.7e)
- Per-site credential probe + adapters for WordPress / WooCommerce / Gitea, tier-fit unions granted ∪ roles, capability badge UI with HTMX partial re-check, install hint in every companion-unreachable error.

Companion plugin overhaul
- Renamed wordpress-plugin/airano-mcp-seo-bridge → wordpress-plugin/airano-mcp-bridge.
- Eight new endpoints: /capabilities, /bulk-meta, /export, /cache-purge, /transient-flush, /site-health, /audit-hook, /upload-and-attach.
- wp.org Plugin Check pass: i18n, WP_Filesystem, scheme allowlist on audit-hook URL.

Other
- Gitea ergonomics (F.17): batch files, tree, search, compare, releases, fork.
- Opportunistic bcrypt upgrade for legacy SHA-256 admin keys (F.8).
- n8n refactor: structured errors, capability probe, missing tools backfilled.
- Idempotency-Key dedup for AI media upload retries; WP client fast-fails on unreachable sites.

Docs
- README + CLAUDE.md drop the fixed "633 tools" claim. The total grows with each release; per-plugin approximations + dashboard-surfaced counts replace it.
- Tools/Tests badges removed in favour of "Plugins: 10".

Deployment
- PyPI mirror chain, optional BUILD_HTTP_PROXY, Alpine→Yandex apk mirror, Debian-slim Plan-B Dockerfile, mirror.gcr.io variant.

CI
- Black + Ruff clean on Python 3.12; pytest tests/ green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/test_tool_access_visibility.py

@@ -0,0 +1,117 @@
+"""F.X.fix #8 — Tool Access hides AI tools until a provider key is set.
+
+Regression: ``wordpress_generate_and_upload_image`` appeared as
+available in the Tool Access list even when the site had no AI
+provider key configured. User only discovered at call time via
+``NO_PROVIDER_KEY``. Fix: each tool row now carries
+``provider_key_required`` + ``provider_key_configured`` so the
+template can gray the tool out and render a "Configure key" CTA.
+"""
+
+from __future__ import annotations
+
+from unittest.mock import AsyncMock, patch
+
+import pytest
+
+from core.tool_access import (
+    _tool_has_configured_provider,
+    _tool_requires_provider_key,
+    get_tool_access_manager,
+)
+
+
+class TestProviderKeyHelpers:
+    def test_ai_image_tool_requires_key(self):
+        assert _tool_requires_provider_key("wordpress_generate_and_upload_image")
+
+    def test_normal_tool_does_not_require_key(self):
+        assert not _tool_requires_provider_key("wordpress_create_post")
+        assert not _tool_requires_provider_key("wordpress_list_posts")
+
+    def test_configured_helper_returns_true_for_non_ai_tools(self):
+        # Non-AI tools aren't gated; they're always "configured".
+        assert _tool_has_configured_provider("wordpress_create_post", set())
+
+    def test_configured_helper_gates_ai_on_providers_set(self):
+        assert not _tool_has_configured_provider("wordpress_generate_and_upload_image", set())
+        assert _tool_has_configured_provider("wordpress_generate_and_upload_image", {"openrouter"})
+
+
+class _FakeToolDef:
+    """Minimal ToolDefinition stand-in for the registry mock."""
+
+    def __init__(self, name: str, category: str = "content"):
+        self.name = name
+        self.description = f"desc for {name}"
+        self.plugin_type = "wordpress"
+        self.category = category
+        self.sensitivity = "low"
+        self.required_scope = "read"
+
+
+class TestListToolsForSiteAnnotatesProviderKey:
+    @pytest.fixture
+    def fake_tools(self):
+        return [
+            _FakeToolDef("wordpress_list_posts"),
+            _FakeToolDef("wordpress_create_post", category="content"),
+            _FakeToolDef("wordpress_generate_and_upload_image", category="media"),
+        ]
+
+    @pytest.mark.asyncio
+    async def test_ai_tool_flagged_not_configured_when_site_has_no_keys(self, fake_tools):
+        manager = get_tool_access_manager()
+        fake_db = AsyncMock()
+        fake_db.get_site_tool_toggles = AsyncMock(return_value={})
+        fake_registry = AsyncMock()
+        fake_registry.get_by_plugin_type = lambda plugin_type: fake_tools
+        with (
+            patch("core.database.get_database", return_value=fake_db),
+            patch("core.tool_registry.get_tool_registry", return_value=fake_registry),
+            patch("core.site_api.list_site_providers_set", new=AsyncMock(return_value=set())),
+        ):
+            rows = await manager.list_tools_for_site("site-1", "wordpress")
+
+        ai = next(r for r in rows if r["name"] == "wordpress_generate_and_upload_image")
+        assert ai["provider_key_required"] is True
+        assert ai["provider_key_configured"] is False
+
+    @pytest.mark.asyncio
+    async def test_ai_tool_flagged_configured_when_site_has_openrouter_key(self, fake_tools):
+        manager = get_tool_access_manager()
+        fake_db = AsyncMock()
+        fake_db.get_site_tool_toggles = AsyncMock(return_value={})
+        fake_registry = AsyncMock()
+        fake_registry.get_by_plugin_type = lambda plugin_type: fake_tools
+        with (
+            patch("core.database.get_database", return_value=fake_db),
+            patch("core.tool_registry.get_tool_registry", return_value=fake_registry),
+            patch(
+                "core.site_api.list_site_providers_set",
+                new=AsyncMock(return_value={"openrouter"}),
+            ),
+        ):
+            rows = await manager.list_tools_for_site("site-1", "wordpress")
+
+        ai = next(r for r in rows if r["name"] == "wordpress_generate_and_upload_image")
+        assert ai["provider_key_required"] is True
+        assert ai["provider_key_configured"] is True
+
+    @pytest.mark.asyncio
+    async def test_non_ai_tool_always_shows_configured_regardless_of_keys(self, fake_tools):
+        manager = get_tool_access_manager()
+        fake_db = AsyncMock()
+        fake_db.get_site_tool_toggles = AsyncMock(return_value={})
+        fake_registry = AsyncMock()
+        fake_registry.get_by_plugin_type = lambda plugin_type: fake_tools
+        with (
+            patch("core.database.get_database", return_value=fake_db),
+            patch("core.tool_registry.get_tool_registry", return_value=fake_registry),
+            patch("core.site_api.list_site_providers_set", new=AsyncMock(return_value=set())),
+        ):
+            rows = await manager.list_tools_for_site("site-1", "wordpress")
+
+        non_ai = next(r for r in rows if r["name"] == "wordpress_create_post")
+        assert non_ai["provider_key_required"] is False
+        assert non_ai["provider_key_configured"] is True