Module filtering
New PFSENSE_MODULES and PFSENSE_READ_ONLY environment variables to control which tools are registered at import time.
PFSENSE_MODULES: comma-separated list of modules to enable (default: all 19). Cuts tool count from 677 to only what you need — e.g. a homelab WireGuard router loads ~250 tools instead of 677.PFSENSE_READ_ONLY=true: strips all mutation tools (POST/PATCH/PUT/DELETE), leaving only read operations.pfsense_report_issueis always available regardless of configuration.- 85 spec-derived pytest tests validate module gating with zero hardcoded counts.
Example — homelab WireGuard router:
PFSENSE_MODULES=firewall,vpn_wireguard,services_dhcp,services_dns_resolver,services_misc,routing,interface,system,status,diagnostics,user,auth
Example — read-only monitoring:
PFSENSE_MODULES=firewall,status,diagnostics
PFSENSE_READ_ONLY=true
Closes #1.