v1.1.0

Defense-in-depth and onboarding release. Public MCP tool contract is
unchanged from 1.0.0 (95 pfSense READ tools + 2 documentation guidance
tools, 0 default-reachable WRITE = 97 total) — this release is not a
capability expansion.

The headline addition is managed READ-only credential provisioning: a
dedicated, project-provisioned pfsense-mcp-readonly pfSense service
account holding exactly the 94 READ privileges this project documents —
live-LAB-verified to receive HTTP 403 AUTH_AUTHORIZATION_FAILED when used
directly against this project's own reviewed WRITE endpoint, i.e. rejected
by pfSense itself, not only by this server's tool surface. This is the
recommended path for new read_only setups via the setup wizard;
bring-your-own-key remains fully supported, unchanged by default, for
existing installations.

Added

• Managed READ-only service-account provisioning — a fixed, dedicated
  pfsense-mcp-readonly identity, entirely separate namespace/journal/
  lock/custody state from the write_protected pfsense-mcp account.
  Reachable via pfsense-mcp-security bootstrap --target-profile read_only and pfsense-mcp-security recover --target-profile read_only.
• Setup-wizard integration for managed READ-only provisioning. A new
  "Account" wizard step (read_only postures only) offers a dedicated
  least-privilege account [Recommended] alongside the existing
  bring-your-own-key option. The managed-vs-BYOK choice is security-bound
  into the setup plan, its digest, and the apply-time confirmation token —
  a confirmed BYOK plan can never be substituted for a managed-provisioning
  apply, or vice versa.
• --target-profile {write_protected,read_only} flag on
  bootstrap/recover — explicit, additive; defaults to
  write_protected (unchanged behavior for every existing invocation).

Fixed

• Recovery cross-profile isolation. Inline recovery inspection now
  threads the correct target profile explicitly from the caller that
  determined which bootstrap composition failed, instead of always
  inspecting the write_protected account's journal.
• Operation-journal account/profile allowlist is now a closed,
  hardcoded pair set — both fields must still match together; no other
  account/profile combination can ever create a journal record.
• docs/PFSENSE_LEAST_PRIVILEGE_MATRIX.md staleness (understated the
  verified pfSense-pkg-RESTAPI version range).

Changed

• Verified pfSense-pkg-RESTAPI version range extended to v2.10.2
  (from v2.10.0), re-verified directly against pinned source at both
  v2.10.1 and v2.10.2.
• MCP tool-surface architecture reviewed and retained. An empirical
  benchmark found no measurable selection-accuracy problem with the
  current 97-tool explicit surface. Two non-generic alternatives were
  designed and benchmarked but not adopted — no production architecture
  change was made.

Full detail: CHANGELOG.md.