feat: reflect netOrk v0.10.0–v0.11.0 release notes

Corrects a claim from the previous update: Satellite Phase 3 shipped, so
discovery scans now run through satellite-covered sites too (only SNMP
health-metric polling and WebSSH remain Central-only).

New capabilities added to the feature list: per-device availability
windows (suppress false OFFLINE warnings during expected downtime),
per-SSID MAC access-control lists with a dedicated Wireless ACL tab, a
new RADIUS Management section (global FreeRADIUS server/NAS/user
management), and three OPNsense monitoring additions (BGP neighbors, TLS
certificate/Trust-store monitoring, DDNS-down warning). Also notes that
netOrk's own config pushes are now auto-recognized so they're never
mistaken for an unauthorized change.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/PAGES.md

@@ -273,10 +273,11 @@ sticky section nav). One section per capability area.
 11. Dashboards
 12. Security Integrations
 13. DNS Management
-14. Access Control (RBAC)
-15. NetBox Sync
-16. Compliance & Audit (NIS2)
-17. Developer Experience
+14. RADIUS Management
+15. Access Control (RBAC)
+16. NetBox Sync
+17. Compliance & Audit (NIS2)
+18. Developer Experience
 
 Each section: `text-xl font-semibold text-slate-200` heading +
 feature items as a clean list with `text-slate-400` body.

docs/PRODUCT.md

@@ -145,6 +145,13 @@ Plus all built-in NAPALM drivers: Cisco IOS/IOS-XE/NX-OS, Arista EOS, Juniper Ju
 - Subnet browser with interface-to-subnet assignments
 - VLAN list grouped by site; per-VLAN device membership view
 - SSID management with push to OpenWRT APs via UCI
+- Per-SSID MAC access control lists (whitelist / blacklist) pushed to every
+  AP broadcasting the SSID, quick-add straight from the Connected Clients list
+- MAC ACL state is a first-class drift item — covered by the same drift
+  detection, scheduled auto-fix, and warning aggregation as any other config
+  drift
+- Dedicated Access Control Lists tab on the Wireless page listing every SSID
+  with its ACL editor inline
 
 ### Configuration Management
 - Config drift detection: desired state (DB) vs device state (poll snapshot)
@@ -156,6 +163,9 @@ Plus all built-in NAPALM drivers: Cisco IOS/IOS-XE/NX-OS, Arista EOS, Juniper Ju
   between any two points in time
 - One-click config restore for OPNsense from any prior snapshot
 - Unauthorised configuration changes are surfaced as a device warning
+- netOrk's own config pushes (drift fixes, ACL provisioning) are recognized
+  and auto-accepted as the new baseline — never mistaken for an unauthorized
+  change
 
 ### Configuration Automation (Ansible)
 - Reusable Ansible roles and playbooks stored and edited directly in
@@ -194,9 +204,10 @@ Plus all built-in NAPALM drivers: Cisco IOS/IOS-XE/NX-OS, Arista EOS, Juniper Ju
 - Scheduled/on-demand reboots and the SNMP auto-fix flow run through the
   same command channel whether a device is directly reachable or behind a
   satellite
-- Not yet satellite-covered: discovery scans and SNMP health-metric polling
-  still run from Central, and WebSSH console access isn't available through
-  a satellite
+- Discovery jobs at a satellite-covered site scan locally through the same
+  command channel, instead of failing to reach the subnet from Central
+- Not yet satellite-covered: SNMP health-metric polling still runs from
+  Central, and WebSSH console access isn't available through a satellite
 
 ### Monitoring & Health
 - SNMP health metrics (CPU, memory, interface counters) via `get_health_metrics()`
@@ -207,6 +218,13 @@ Plus all built-in NAPALM drivers: Cisco IOS/IOS-XE/NX-OS, Arista EOS, Juniper Ju
 - Docker container and image status (Proxmox/Linux)
 - Service status and start/stop/restart (systemd)
 - VM/container list with OS device cross-linking (Proxmox)
+- Per-device availability windows — suppress OFFLINE status and poll-failure
+  warnings during expected downtime (e.g. a nightly power-off); opt-in,
+  unconfigured devices are unaffected
+- OPNsense: BGP neighbor status polling and display, with a peer-down warning
+- OPNsense: TLS certificate monitoring for the Trust store, with
+  expiring-soon / expired warnings
+- OPNsense: Dynamic DNS service-down warning (os-ddclient)
 
 ### Dashboards
 - Configurable, shareable dashboards — build your own from a widget picker
@@ -236,6 +254,17 @@ Plus all built-in NAPALM drivers: Cisco IOS/IOS-XE/NX-OS, Arista EOS, Juniper Ju
 - PTR record provisioning to reverse zones
 - Pending job queue for zone changes when device is unreachable
 
+### RADIUS Management
+- Global FreeRADIUS server, NAS client, and user management — no site
+  scoping, usable from any site's SSIDs/APs
+- Changes push to the device via the driver and are only stored after the
+  device confirms — avoids drift between netOrk's view and the actual
+  FreeRADIUS config
+- Dedicated server list and detail page (NAS clients / users tabs) under
+  the Wireless section
+- SSID 802.1X integration (auto-provisioning a NAS client from an SSID's
+  RADIUS server) is a deliberate follow-up, not included yet
+
 ### Access Control
 - JWT authentication with remember-me (localStorage) or session-only (sessionStorage)
 - Two-factor authentication (MFA/TOTP) — authenticator app at login, backup