v0.9.13 — discovery scope fix, Grok Business/Enterprise support

A regression fix from 0.9.12 plus Grok Business / Enterprise support.

Fixed

• This plugin was answering other plugins' OAuth discovery requests. 0.9.12 added a second discovery address so each of your MCP servers could be described individually. One half of that change was too broad: any request to /.well-known/oauth-authorization-server/ followed by anything was answered with this site's own sign-in details, whatever had actually been asked for. On a site where another plugin runs its own MCP server, that meant we could answer on its behalf and hand an AI assistant the wrong sign-in addresses. Which plugin won depended on the order WordPress happened to have cached its URL rules in, so it came and went unpredictably.
  That address is no longer claimed — it never applied to this plugin in the first place. Per-server discovery is unchanged: the address AI assistants actually use is untouched, and the multi-server fix from 0.9.12 is unaffected.
• Generated OAuth credentials now appear directly under the Generate button, instead of at the bottom of the card below the whole "How to connect" section. The client secret is only ever shown once, and it was sitting below a page of setup steps. Affects every connector tab.
• The Grok instructions no longer contradict themselves. "Leave the Advanced OAuth fields empty" now says plainly that it applies to grok.com only, and the Team / Enterprise steps say that surface needs the generated credentials.

New

• Grok Business and Enterprise accounts can now be connected. Grok has two places to add a connector and they behave differently. On an individual grok.com account Grok registers itself and you leave the OAuth fields blank. On the Business / Enterprise admin surface at console.x.ai that self-registration does not happen and the form demands OAuth credentials — which this plugin previously refused to issue for Grok, leaving those accounts with no way to connect at all.
  The Grok tab now offers Generate credentials, and the instructions list every value the form asks for, including the Authorization Endpoint, Token Endpoint, Scopes and Token Auth Method. Those addresses were missing before, so even an operator who obtained credentials elsewhere could not complete the form. Verified end-to-end against a real console.x.ai connect.

Upgrade note

No action needed. The URL routing rules are refreshed automatically on upgrade.

Full changelog: v0.9.12…v0.9.13