Per-command RBAC against built-in MongoDB roles; geo work complete
v0.3.0a46 ships role-based access control: every command is now gated by per-command privilege checks against the built-in MongoDB roles (read, readWrite, dbAdmin, userAdmin, clusterAdmin, etc.). Role assignments come from the standard system.users / system.roles collections. Connection-time SCRAM-SHA-1 / SCRAM-SHA-256 + post-auth privilege checks now match mongod's authorization model closely enough that pymongo's auth conformance tests pass against an embedded SecantusDB.
The geo work also reaches a checkpoint: compound geo+scalar index tests are in, and the geo backlog item is marked complete. Side-quest: the website got an invoke publish shortcut for test-suite-free deploys, plus changelog blog posts (which you're now reading).