WPPilot 1.18.2 — Cloud and OAuth connectors can run every ability again

• Fixed: with WPPilot Cloud or an OAuth connector (Claude, ChatGPT), abilities that work through WordPress's own REST API failed with "This OAuth credential is not accepted on the requested REST route." That broke the block themes kit (Global Styles, templates, patterns, navigation), the block theme path of wppilot/build-site-header, Cloud's "Back up now" with All-in-One WP Migration, and WPPilot Pro abilities that use WordPress REST (WooCommerce reports, Etch, GeneratePress, Meta Box relationships, Site Kit). The access-token route limit now lets through a REST call an ability makes for itself while serving an MCP request that already passed it; that call still runs the route's own permission check as the token's user. A token sent straight to any other REST route, including inside a REST batch request, is still refused with 403. Application Password connections were not affected.
• Fixed: Dashboard > Updates > Check again now fetches WPPilot's release data instead of answering from a 12-hour cache, so a new release shows at once.