v2.1.0-beta.4

Security

• Tool calls now execute as the token's owner instead of a substituted admin
  (admins[0]); ha_auth likewise acts on the caller. Mutating ops fail closed
  with no user.
• Admin-only operations now require an admin token: mutations on ha_registry,
  ha_config_entries, ha_config_flow, ha_energy, ha_statistics,
  ha_set_state, ha_delete_state, ha_yaml_config, ha_blueprint,
  ha_recorder, ha_system, ha_hacs, plus sensitive reads (ha_system
  logs/get_config, ha_config_entries list/get, ha_diagnostics).
• ha_blueprint import/delete reject path-traversal; ha_hacs op=download
  reclassified destructive; ha_render_template gains a best-effort render
  guard; ha_fire_event and ha_config_flow/ha_diagnostics/ha_config_entries
  reads are admin-gated.
• Rate limiter now counts JSON-RPC batches (capped at 100); the endpoint fails
  closed when the integration is unloaded.

Changed

• Meta-tool permissions are gated per op via write_ops/destructive_ops.
  Destructive ops (delete/remove/purge/revoke/restore/clear) now require
  allow_destructive (default off) rather than allow_write.