Add CHANGELOG; switch runbook rollback to tags

- CHANGELOG.md started (Keep a Changelog style), with the v0.1.0 release
  notes; versions track the git tags and __version__.
- Runbook §7 now deploys a specific tag (git fetch --tags && checkout
  vX.Y.Z) and rolls back to the previous tag, with a note that rollback
  reverts code not data (restore the data backup if a migration ran).

(The deploy kickoff brief lives in planning/, which is gitignored — it's a
local hand-to-the-agent note, not shipped in the repo.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -0,0 +1,48 @@
+# Changelog
+
+All notable changes to Daybook are recorded here. Format loosely follows
+[Keep a Changelog](https://keepachangelog.com/); versions are SemVer and match
+the git tags (`vX.Y.Z`) and `daybook_project.__version__`.
+
+## [Unreleased]
+
+_Nothing yet._
+
+## [0.1.0] — 2026-09-03
+
+First tagged release.
+
+### Artifacts & rendering
+- Artifact kinds: `markdown`, `html_fragment`, `html_full`, `deck`, `json`,
+  `csv`, `image`, `pdf`, `binary`.
+- `.xlsx` uploads convert server-side to a `csv` artifact (active sheet,
+  saved formula results).
+- Markdown code blocks get syntax highlighting; tables (markdown &
+  html_fragment) render styled — monospace cells, sans-serif headers.
+- `json`/`csv` render as an interactive collapsible tree / sortable table
+  (Grid.js + renderjson, vendored locally).
+- Unified off-white document background; system sans-serif body text.
+
+### API
+- `POST/GET/PATCH/DELETE /api/artifacts`, list filters (source/label/day/
+  kind/q), `/api/assets` image upload, `/api/capabilities` (reports
+  `version`). Per-user bearer-token ingest; session-authed reads.
+- Server-side validation: per-kind content shape, field length limits,
+  string-typed source fields, valid-JSON for `json`.
+
+### Sharing, quotas, security
+- Per-artifact public share links (`/s/{token}`), owner-toggled, revocable.
+- Per-user disk quotas with oldest-unkept auto-eviction and a Keep flag.
+- Allowlist HTML sanitization (nh3) + `script-src 'none'` CSP for the themed
+  kinds; deep-JSON parse errors return 400 (not 500).
+
+### UI
+- Multi-user auth; feed with source sidebar + label filtering; settings area
+  (Account, Storage, Demo Data, Users, About); light/dark toggle; app icon.
+
+### Deployment
+- Dockerised (Gunicorn + whitenoise), SQLite, `git`-based deploy with a
+  runbook (`deploy/cloud_agent_deploy.md`) and health check.
+
+[Unreleased]: https://git.cygnus.systems/peter/daybook/compare/v0.1.0...HEAD
+[0.1.0]: https://git.cygnus.systems/peter/daybook/releases/tag/v0.1.0