1.0.1

Fixes from the GPM review (getgrav/grav#4276):

Fixed

• Grav 2.0 (admin2/API stack): the connect flow never ran — Plugin::isAdmin() is unreliable there. The handshake now subscribes onAdminAfterSave unconditionally and reads submitted values from the saved config object.
• "Exclude logged-in admins" no longer excludes every authenticated user; exclusion is permission-based (admin.login / api.access), so front-end members are still tracked.
• The API key field is now password instead of clear text.

Improved

• The verification handshake runs only from the save handler (~5s total timeout), never on the page-render path.
• api_base must be HTTPS; otherwise the default applies (the API key is sent to this host).
• The verification challenge is cleared once the handshake completes.
• data-domain prefers the configured site URL (system.custom_base_url) over the Host header (cache-poisoning safe).
• connected/challenge are no longer form fields (internal state).
• Added a docs field to the manifest; plugin class renamed to MxCookielessAnalyticsPlugin.

Tested on Grav 2.0.23 (injection, challenge endpoint, Host-header poisoning scenario) plus a 21-check stub harness.