chore(release): v1.0.0

Primeira versão estável: valida ponta a ponta contra hardware real (Evil
Twin PSK e Enterprise, WPS, quebra com regras/máscara, relatório) e fecha
o roadmap de 0.1.0 quase inteiro. Changelog completo em CHANGELOG.md.

- Cargo.toml (workspace + app desktop) e tauri.conf.json: 0.1.0 → 1.0.0.
- README/ROADMAP (EN+PT-BR): refletem o que de fato existe agora
  (regras/máscara, .hc22000, WPS, Evil Twin, relatório), não mais "Next".
- docs/cli.md e docs/interface.md (EN+PT-BR): documentam --rules no
  crack e a aba Ataques/relatório da interface.

ROADMAP.md

@@ -2,34 +2,37 @@
 
 **English** · [Português](ROADMAP.pt-BR.md)
 
-Sabiá does Wi-Fi auditing: it discovers networks, captures handshakes (4-way and PMKID), cracks WPA/WPA2-PSK by offline dictionary and tests deauthentication with authorization. Always for authorized use, with a local audit trail.
+Sabiá does Wi-Fi auditing: it discovers networks, captures handshakes (4-way and PMKID), cracks WPA/WPA2-PSK by dictionary/rules/mask, assesses WPS, PMF and evil twin exposure, and tests deauthentication and rogue-AP attacks with authorization. Always for authorized use, with a local audit trail.
 
-## Done (0.1.0)
+## Done (1.0.0)
 
-- **Monitor mode** and channel control via netlink/`iw`.
-- **Scanning** of 2.4, 5 and 6 GHz: APs and clients, with SSID, BSSID, channel, signal and security.
+- **Monitor mode** and channel control via netlink/`iw`, with automatic recovery from NetworkManager reclaiming the interface.
+- **Scanning** of 2.4, 5 and 6 GHz: APs and clients, with SSID, BSSID, channel, signal, security, WPS details, vendor and PHY standard.
 - Raw 802.11 capture via **AF_PACKET** (no libpcap), **radiotap** and management-frame parsing.
-- Capture of the **4-way handshake (EAPOL)** and the **PMKID**.
-- **Offline dictionary cracking** (PBKDF2-HMAC-SHA1, MIC and PMKID) for WPA/WPA2-PSK.
+- Capture of the **4-way handshake (EAPOL)** and the **PMKID**; **CCMP traffic decryption** once the password is known.
+- **Offline cracking** (PBKDF2-HMAC-SHA1, MIC and PMKID) for WPA/WPA2-PSK: a 9.7M-password dictionary (rockyou + Probable-Wordlists) by default, hashcat-style **mutation rules** and **mask brute force**.
+- **`.hc22000` export** to take the handshake straight to hashcat/John.
 - **`.pcap`** read and write; offline `.pcap` analysis.
-- Authorized **`deauth`** (`--yes` flag).
+- Authorized **`deauth`** (`--yes` flag), directional and continuous jobs, PMF probing, clientless PMKID hunting.
+- **WPS attack** (PIN/Pixie Dust) via a bundled reaver, or bully when installed.
+- **Evil Twin** with captive portal for WPA/WPA2-PSK (password only accepted after cryptographic verification against the real handshake) and a credential-capture variant for WPA2/WPA3-Enterprise (802.1X/EAP).
+- Channel-interference scoring and security findings (open network, no PMF, WPS exposed, possible evil twin).
+- Redesigned, paginated **audit report** (cover, table of contents, running header/footer) that prints to PDF from the browser.
 - Local hash-chained **audit trail**; `doctor` diagnostics.
 - **CLI** + **desktop app** (Tauri) + local UI server; **one-click update**.
 
 ## Next
 
-- **Rules and masks** in cracking (hashcat style), beyond the plain dictionary.
-- **`22000` export** to take the handshake straight to hashcat/John.
 - **GPU** acceleration for PMK derivation.
-
-## Later
-
-- **WPS attack** (PIN/Pixie Dust) in authorized testing.
-- **Rogue AP / evil twin** for client assessment, with authorization.
 - **Capture on Windows** via Npcap.
 
-## Long term
+## Later
 
 - **WPA3/SAE**: detection and downgrade paths where applicable.
 - Validation on **varied hardware** (chipsets and regulatory domains).
 - Signing of release binaries (SmartScreen/Gatekeeper).
+
+## Long term
+
+- GPU-accelerated cracking backend (hashcat integration beyond export).
+- Packaged distribution (`apt`/`brew`/winget).