Stable v2.9.6

• fix(wordpress): correct nginx-hardening fix -- location order made it inert
• feat(mcp-server): expand tool coverage toward Ploi.io MCP parity
• fix(wordpress): block direct execution of wp-admin/includes + wp-includes PHP
• fix(mcp-server): list_sites/list_databases used wrong field names
• fix(mcp-server): decode /sites and /databases as paginated envelopes
• feat(mcp-server): add MCP protocol extension for external AI clients
• fix(dashboard): cap and scroll the What's New box instead of full-width
• feat(installer): enable filesystem disk quota automatically on fresh installs