1.0.1

Fixes from the GPM review (getgrav/grav#4276):

Fixed

• Grav 2.0 (admin2/API stack): the connect flow never ran — Plugin::isAdmin() is unreliable there. The handshake now subscribes onAdminAfterSave unconditionally and reads submitted values from the saved config object.
• "Exclude logged-in admins" no longer excludes every authenticated user; exclusion is permission-based (admin.login / api.access), so front-end members are still tracked.
• The API key field is now password instead of clear text.

Improved

• The verification handshake runs only from the save handler (~5s total timeout), never on the page-render path.
• api_base must be HTTPS; otherwise the default applies (the API key is sent to this host).
• The verification challenge is cleared once the handshake completes.
• data-domain prefers the configured site URL (system.custom_base_url) over the Host header (cache-poisoning safe).
• connected/challenge are no longer form fields (internal state).
• Added a docs field to the manifest; plugin class renamed to MxCookielessAnalyticsPlugin.

Tested on Grav 2.0.23 (injection, challenge endpoint, Host-header poisoning scenario) plus a 21-check stub harness.

1.0.0

Initial release of the MX Cookieless Analytics plugin for Grav CMS.

• Opt-in tracker injection: off by default, nothing loads or sends until you connect and enable tracking
• Automatic site verification via challenge/response (no DNS records needed)
• Admin-panel settings with auto-connect on save
• Logged-in admin exclusion (on by default)
• Works with full-page caching; tracker served with a versioned cache-bust URL

Requires Grav 1.7+ (tested on Grav 2.0.22). MIT licensed.