feat: reflect netOrk v0.4.0 features (MFA, config backup, ack warnings)

Moves MFA/TOTP and config backup & versioning from roadmap to shipped
across the NIS2 coverage page, features list, and roadmap, and adds a
homepage screenshot row for the new config snapshot/diff/restore UI.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs/PAGES.md

@@ -147,6 +147,15 @@ Each badge uses the `Driver / Integration Badge` component from DESIGN.md.
   agent is missing. Graylog syslog forwarding status with auto-fix.`
 - Screenshot: SecurityTab inside DeviceDetailPage
 
+**Row 4 — Right text, left screenshot**
+- Heading: `Configuration backup and versioning`
+- Copy: `Every poll captures a config snapshot into a local Git
+  repository. The Config tab shows the full snapshot history, a
+  side-by-side diff between any two points in time, and — for
+  OPNsense — a Restore button. Unauthorized changes show up as a
+  device warning.`
+- Screenshot: ConfigTab inside DeviceDetailPage
+
 ---
 
 ### Section 5b — NIS2
@@ -330,7 +339,6 @@ address NIS2 Art. 21 technical baseline requirements.
 
 **Planned items (NIS2-tagged):**
 - CVE tracking per device — NVD / OSV cross-reference
-- Configuration backup & versioning — git-backed snapshots, change detection
 - Compliance dashboard — per-site Art. 21 checklist view
 - Audit log export — PDF / CSV with filters
 
@@ -342,7 +350,6 @@ address NIS2 Art. 21 technical baseline requirements.
 **Under consideration (NIS2-tagged):**
 - Incident workflow — structured record + NIS2 Art. 23 Fristen-Tracker
 - EOL tracking — endoflife.date integration for firmware / OS
-- MFA (TOTP) — second factor for netOrk logins
 
 **Under consideration (general):**
 - mDNS scanner — media device discovery