chore(release): v1.0.0

Primeira versão estável: valida ponta a ponta contra hardware real (Evil
Twin PSK e Enterprise, WPS, quebra com regras/máscara, relatório) e fecha
o roadmap de 0.1.0 quase inteiro. Changelog completo em CHANGELOG.md.

- Cargo.toml (workspace + app desktop) e tauri.conf.json: 0.1.0 → 1.0.0.
- README/ROADMAP (EN+PT-BR): refletem o que de fato existe agora
  (regras/máscara, .hc22000, WPS, Evil Twin, relatório), não mais "Next".
- docs/cli.md e docs/interface.md (EN+PT-BR): documentam --rules no
  crack e a aba Ataques/relatório da interface.

CHANGELOG.md

@@ -4,6 +4,73 @@
 
 Format based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versions follow SemVer.
 
+## [1.0.0] - 2026-10-24
+
+First stable release: real-hardware validation across the whole attack surface, a much more complete cracking pipeline, two new attacks (WPS, Evil Twin), a redesigned report, and several reliability fixes found only by testing against live Wi-Fi networks.
+
+### Added
+- **Cracking:** default dictionary replaced by a 9.7M-password list (rockyou +
+  Probable-Wordlists, deduplicated, gzip-embedded); hashcat-style **mutation
+  rules** (uppercase, numeric/symbol suffixes, simple leet); **mask brute
+  force** (`?d?l?u?s?a` syntax); **`.hc22000` export** (single or batch) to
+  hand a handshake to hashcat/John.
+- **WPS attack:** PIN/Pixie Dust via a bundled `reaver` (extracted at
+  runtime), or `bully` when installed on the system.
+- **Evil Twin:** clones an already-seen AP (open SSID) on a second interface
+  with a captive portal, for WPA/WPA2-PSK — the submitted password is only
+  accepted after being verified against the real captured handshake, never
+  "accepts anything". An **Enterprise (802.1X/EAP)** variant captures
+  credentials automatically via `hostapd-wpe`, no portal or human action
+  needed, since the credential travels in the EAP handshake itself.
+- **CCMP traffic decryption** for a client once its handshake's password is
+  known (Temporal Key derived from the cracked PMK).
+- **Channel-interference scoring** per band and **security findings** (open
+  network, missing PMF, WPS exposed, possible evil twin by duplicate SSID).
+- **Redesigned audit report:** full-page cover with embedded logo, table of
+  contents, running header/footer via `@page` margin boxes (current
+  section, page numbers), KPI and findings cards with severity colors —
+  still paginated by Paged.js in the browser, printable to PDF.
+- `ScanSnapshot.warning`: tells you when a capture has been running for a
+  while without receiving a single frame — a card that accepts turning
+  monitor mode on without actually delivering capture (common with
+  built-in laptop Wi-Fi) now says so, instead of silently "listening".
+
+### Fixed
+- **Handshake capture never completed on real networks:** `eapol.rs` read
+  `key_info`/`replay_counter`/`key_data_len` as little-endian; those
+  802.1X fields are big-endian. Deauth worked, EAPOL frames were seen, but
+  `HandshakeTracker` silently discarded every one — 0 handshakes no matter
+  how much traffic was generated. The project's own synthetic test frames
+  made the same mistake symmetrically, so round-trip tests never caught
+  it; verified live against a real AP after the fix.
+- **Monitor mode fighting NetworkManager:** `set_monitor()` now releases
+  the interface from NetworkManager before switching modes and returns it
+  afterward — without this, NM reasserted its own connection within
+  seconds and capture died with "is in managed mode".
+- **Evil Twin left the system half-configured if the process died mid-run**
+  (Ctrl+C, `kill -9`, power loss): both interfaces stuck `managed=no`
+  forever, Wi-Fi gone from the system panel. A state file plus a
+  self-healing pass on every engine start now undoes this automatically;
+  `sabia ui` also handles SIGINT gracefully.
+- **Repeated deauth/disassoc frames were dropped as duplicates** after the
+  first send — the same Sequence Control was reused on every injection;
+  now increments per frame.
+- **Network list reordered under the cursor** during capture, as signal-based
+  sorting reacted to every 1-2 dBm fluctuation; order is now stable
+  (arrival order, signal rounded to 4 dBm buckets).
+- **"Force handshake" failed if capture had been stopped:** it now resumes
+  capture automatically and waits for the target to reappear with a known
+  channel before starting the job, instead of locking onto whatever
+  channel the scanner happened to be hopping through.
+- **Attacks tab layout left large empty gaps** when two cards of very
+  different heights shared a grid row; switched to a masonry-style column
+  layout.
+
+### Changed
+- `crack_reader`/`crack_mask` parallelize across available cores and reuse
+  the HMAC base per iteration instead of reconstructing it — roughly 640x
+  faster in release builds versus the original debug/single-thread path.
+
 ## [0.1.0] - 2026-10-23
 
 First release: CLI, desktop app and shared core.