Fix plugin security, hooks system, and admin features

- Add plugin allowlist (enabled_plugins in config.json)
- Add enable/disable toggle in admin (separate from visibility)
- Add plugin hooks system (actions + filters with auto-registration)
- Fix autoLinkPageTitles nested <a> tag vulnerability
- Move MQTT credentials to environment variables
- Preserve current page in language switcher
- Fix ctime/birthtime for file creation date
- Deduplicate getGuidePage() CommonMark setup
- Simplify formatDisplayName() logic
- Add admin activity log to dashboard
- Add own password change with current password verification
- Apply theme header_color to admin sidebar
- Add content preview button in editor

plugins/MQTTTracker/MQTTTracker.php

@@ -32,11 +32,11 @@ class MQTTTracker
         $this->config = [
             'enabled' => true,
             'viewable' => false,
-            'broker_host' => 'localhost',
-            'broker_port' => 1883,
+            'broker_host' => getenv('MQTT_BROKER_HOST') ?: 'localhost',
+            'broker_port' => getenv('MQTT_BROKER_PORT') ?: 1883,
             'client_id' => 'codepress_cms',
-            'username' => '',
-            'password' => '',
+            'username' => getenv('MQTT_USERNAME') ?: '',
+            'password' => getenv('MQTT_PASSWORD') ?: '',
             'topic_prefix' => 'codepress',
             'track_visitors' => true,
             'track_pages' => true,
@@ -48,7 +48,13 @@ class MQTTTracker
         
         if (file_exists($configFile)) {
             $jsonConfig = json_decode(file_get_contents($configFile), true);
-            $this->config = array_merge($this->config, $jsonConfig);
+            // Only merge non-sensitive keys from config file
+            $sensitiveKeys = ['password', 'username'];
+            foreach ($jsonConfig as $key => $value) {
+                if (!in_array($key, $sensitiveKeys, true)) {
+                    $this->config[$key] = $value;
+                }
+            }
         }
     }