Finalize nx9-wg production release

crates/nx9-wg-db/README.md

@@ -1,12 +1,12 @@
-# nx9-db — SQLite Persistence Layer
+# nx9-wg-db — SQLite Persistence Layer
 
-`nx9-db` provides the authoritative SQLite persistence layer for the `nx9-wg` native Rust WireGuard management system.
+`nx9-wg-db` provides the authoritative SQLite persistence layer for the `nx9-wg` native Rust WireGuard management system.
 
 ## Architectural Boundaries
 
-- **Authoritative State**: SQLite is the authoritative persistent store for `nx9-wg` desired state. It stores what the system intends the network, interfaces, peers, routes, firewall rules, administrator credentials, sessions, tokens, and settings to be.
-- **Separation of Concerns**: SQLite records desired configuration only. Live kernel state (WireGuard interface status, handshake counters, packet counters, live nftables rules, live kernel routes) is queried directly from Linux kernel subsystems in later phases.
-- **SQL Encapsulation**: All SQL queries, SQLite connection lifecycle, migrations, and row conversions are strictly encapsulated inside `nx9-db`. Neither `nx9-core`, `nx9-api`, `nx9-ui`, `nx9-wireguard`, nor `nx9-network` issue SQL directly.
+- **Authoritative State**: SQLite is the authoritative persistent store for `nx9-wg` desired state. It stores what the system intends the network, interfaces, peers, routes, firewall rules, administrator credentials, sessions, tokens, client profiles, and settings to be.
+- **Separation of Concerns**: SQLite records desired configuration only. Live kernel state (WireGuard interface status, handshake counters, packet counters, live nftables rules, live kernel routes) is queried directly from Linux kernel subsystems.
+- **SQL Encapsulation**: All SQL queries, SQLite connection lifecycle, migrations, and row conversions are strictly encapsulated inside `nx9-wg-db`. Neither `nx9-wg-core`, `nx9-wg-api`, `nx9-wg-ui`, `nx9-wireguard`, nor `nx9-wg-network` issue SQL directly.
 
 ## SQLite Configuration
 
@@ -16,7 +16,7 @@ Every connection opened by `Store` enforces:
 - `PRAGMA busy_timeout = 5000` — 5-second busy timeout to avoid contention errors.
 - `PRAGMA synchronous = NORMAL` — Optimal reliability and performance in WAL mode.
 
-## Database Schema (12 Tables)
+## Database Schema (13 Tables)
 
 1. `admin` — Single administrator identity (`CHECK (id = 1)`), Argon2id password hash, TOTP secrets, and login timestamp.
 2. `sessions` — Admin web sessions (`ON DELETE CASCADE`).
@@ -27,20 +27,21 @@ Every connection opened by `Store` enforces:
 7. `networks` — Named network CIDRs for routing and organization.
 8. `routes` — Desired kernel routing rules (`ON DELETE SET NULL`).
 9. `firewall_rules` — Desired firewall policy rules with priorities and directions (`in`, `out`, `forward`).
-10. `settings` — Key-value system settings with secret redaction support.
+10. `settings` — Key-value system settings with secret redaction support and structured WireGuard server endpoint keys.
 11. `audit_events` — Append-only operational audit log with event filtering and pagination.
 12. `backups` — Backup metadata and manifest checksum records.
+13. `client_profiles` — Device, connection, and MTU transport profile specifications with built-in protections.
 
 ## Migration Strategy
 
-- Migrations are defined in `crates/nx9-db/migrations/` and embedded at compile time via `sqlx::migrate!("./migrations")`.
+- Migrations are defined in `crates/nx9-wg-db/migrations/` and embedded at compile time via `sqlx::migrate!("./migrations")`.
 - Migrations are executed automatically via `store.migrate().await?`.
 - Migrations are tracked in the `_sqlx_migrations` table for idempotency.
 
 ## Usage in Code
 
 ```rust
-use nx9_db::Store;
+use nx9_wg_db::Store;
 use std::path::Path;
 
 #[tokio::main]
@@ -63,5 +64,5 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 Tests use isolated in-memory or temporary file SQLite instances:
 
 ```bash
-cargo test -p nx9-db
+cargo test -p nx9-wg-db
 ```