feat: operational tooling — signing, versioning, changelog, roadmap (SPEC-001)

Establish GuruConnect's release engineering and project tracking (SPEC-001):
- docs/ scaffold: FEATURE_ROADMAP, ARCHITECTURE_DECISIONS (ADR-001 standalone+contract,
  ADR-002 Gitea Actions + Azure Trusted Signing), docs/specs/SPEC-001, CHANGELOG.
- .gitea/workflows/release.yml: conventional-commit auto-versioning, git-cliff changelog,
  Windows agent build, Azure Trusted Signing via jsign (reusing the shared ACG cert profile),
  Gitea release via REST API. build-and-test.yml is the PR/push gate; deploy.yml de-duplicated.
- server: GET /api/changelog/:component/:version (latest + by-version), path-traversal hardened.
- cliff.toml; server/.env.example documents CHANGELOG_DIR.

Reviewed (Code Review Agent): axum route-conflict blocker fixed; CHANGELOG ordering, toolchain
target, breaking-change parsing, empty-changelog fallback addressed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -0,0 +1,16 @@
+# Changelog
+
+All notable changes to GuruConnect are documented here. Format follows
+[Keep a Changelog](https://keepachangelog.com/); the project uses semantic versioning.
+
+Per-version entries below are generated from conventional commits (`feat:`, `fix:`, `perf:`)
+by the release workflow; per-component changelogs are also written to
+`changelogs/<component>/v<version>.md` and served at `/api/changelog/...`.
+
+## [0.1.0] - 2026-01-18
+
+### Added
+- Initial GuruConnect: Rust agent (DXGI/GDI capture, input injection, native viewer,
+  `guruconnect://` handler), Axum relay server, protobuf-over-WSS transport.
+- Phase-1 security hardening (JWT, Argon2id, rate limiting, security headers, SEC-1..5),
+  systemd units, automated backups.