MCP server that runs on an OpenWrt router: deny-by-default policy, audit log, rollback-armed config changes