Rolino removed changes

Removed the fixed `rolino-codex` OAuth client and callback. Hosted MCP authentication now uses the standard discovery and client-identification flow without a host-specific server configuration.

The custom interactive CLI authorization pages, exchange and revoke routes, credential format, compatibility readers, and `CliAuthorizationGrant` database model have been removed.

The Rolino CLI now supports exact Blog image generation and local-file upload, image review, confirmed exact-bundle approval, future scheduling, and schedule cancellation while keeping `blog:write`, `blog:approve`, and `blog:publish` independent.

The Rolino SDK now supports exact Blog image generation and upload, image review, confirmed article approval, confirmed scheduling or rescheduling, and confirmed schedule cancellation with Blog-specific typed contracts.

Authorized agents can now generate, upload, and review exact Blog article images with `blog:write`, and preview or execute one confirmed exact approval bundle with the independent `blog:approve` capability. These API operations cannot publish and do not widen existing credentials.

Blog images now use shared exact-revision generation, Blog-specific direct uploads, checksum and type validation, optimistic review, idempotent completion, and approval invalidation without widening post-media access.

Blog revision approval now binds one canonical content, approved-image, and live-link bundle, records user or agent provenance, rejects stale concurrent approvals, and clears approval when a selected image changes.

Blog articles and images now have additive approval, checksum, upload-source, concurrency, and upload-intent fields that preserve existing human approvals and generated images while preparing exact image-bundle safety.

Agent credentials can now opt into an independent `blog:approve` capability for exact Blog article and image-bundle approval without granting draft writing or publication, while existing credentials remain unchanged.

The landing-page footer now links to `llms.txt` and includes a discovery hint for AI agents.

Blog Studio now has a provider-neutral publishing registry, multiple tenant-safe destinations, one primary destination, durable per-destination delivery attempts, stable remote article mappings, and safe retry and reconciliation states.

Blog Studio now includes hidden, security-gated adapters for signed webhooks, self-hosted WordPress, Ghost, and Notion editorial export. These providers remain unavailable until their real-site acceptance gates pass.

Authorized agents can list safe Blog provider capabilities, destinations, and delivery attempts across REST, OpenAPI, SDK, CLI, and MCP, and can bind exact destination IDs into confirmed publication requests.

Blog Studio now offers an agent-first setup workflow across REST, OpenAPI, SDK, CLI, and local MCP so authorized agents can inspect readiness, import a site, create and review cadence plans, create editable articles, and safely configure and verify Next.js delivery.

Agent credentials can now opt into a separate `blog:manage` capability for Blog setup and connection operations without granting it to existing credentials or widening Blog draft and publication permissions.

Blog delivery readiness now distinguishes configured credentials from real delivery use and signed revalidation verification while storing only safe verification metadata.

Blog Studio now has a selected-workspace rollout foundation, a separate Blog navigation module, guarded Plan, Articles, Site, and Settings pages, and additive tenant-safe data records for site catalogs, plans, article revisions, images, durable jobs, publishing, delivery, metrics, and audits.

Blog Studio can now save a secure Next.js site connection and queue a durable website import that blocks private destinations and cross-host redirects, bounds sitemap and page reads, respects robots exclusions, and classifies existing blog articles for review.

Blog Studio can now preview a user-selected cadence across a 30-day window and queue an evidence-aware plan with a separate responsive calendar, truthful frozen metrics, idea details, acceptance, and deterministic duplicate and tenant validation.

Blog Studio articles now support complete Markdown and metadata editing, safe previews, debounced autosave, explicit immutable revisions, optimistic conflict protection, exact-revision approval, revision history, and restoration as a new draft without changing the live published revision.

Blog Studio can now queue one reviewed featured-image candidate through OpenRouter's dedicated Image API, validate model capabilities, cost, format, size, and dimensions, store it at a stable object URL, edit its alt text, approve or reject it, and protect images used by published revisions.

Blog Studio now provides narrow hashed website delivery credentials, published-only versioned APIs with redirects, ETags, and rate limits, a clean-install Next.js 16 package with safe rendering and signed cache revalidation, and exact-revision publication and scheduling with refresh-pending delivery state.

Blog Studio now defines separate opt-in read, draft-write, and approved-revision publish agent scopes without widening existing keys, and records a neutral publication baseline for later aggregate Search Console and Google Analytics matching.

Workspace, Admin, and authentication page changes now use short native crossfades that respect reduced-motion preferences.

Brand Studio now shows Google Analytics and Search Console readiness independently, with source-specific status, recovery guidance, and eligible opportunity counts.

Brand Studio can now generate ideas specifically from unused eligible Google Analytics opportunities while preserving the existing all-source generation flow.

Google Analytics ideas now show bounded aggregate GA4 evidence in Brand Studio and Ideas, including the landing page, reporting period, metrics, and coverage limits.

The landing page now gives visitors a copy-ready prompt for connecting Rolino to an AI agent, with a direct link to a more complete, safety-aware `llms.txt` discovery guide.

Hosted Admin now has a Features section for a disabled-by-default SEO Intelligence rollout, with audited Disabled, Selected workspaces, and All workspaces modes and a preserved workspace allowlist

Operators can open a disabled-by-default, read-only SEO Intelligence v4 preview report generated from stored data, with explicit preview, fixture, and not-delivered labels and no provider, queue, schedule, report-row, or delivery changes