feat: operational tooling — signing, versioning, changelog, roadmap (SPEC-001)

Establish GuruConnect's release engineering and project tracking (SPEC-001):
- docs/ scaffold: FEATURE_ROADMAP, ARCHITECTURE_DECISIONS (ADR-001 standalone+contract,
  ADR-002 Gitea Actions + Azure Trusted Signing), docs/specs/SPEC-001, CHANGELOG.
- .gitea/workflows/release.yml: conventional-commit auto-versioning, git-cliff changelog,
  Windows agent build, Azure Trusted Signing via jsign (reusing the shared ACG cert profile),
  Gitea release via REST API. build-and-test.yml is the PR/push gate; deploy.yml de-duplicated.
- server: GET /api/changelog/:component/:version (latest + by-version), path-traversal hardened.
- cliff.toml; server/.env.example documents CHANGELOG_DIR.

Reviewed (Code Review Agent): axum route-conflict blocker fixed; CHANGELOG ordering, toolchain
target, breaking-change parsing, empty-changelog fallback addressed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/src/main.rs

@@ -304,6 +304,11 @@ async fn main() -> Result<()> {
         .route("/api/releases/:version", put(api::releases::update_release))
         .route("/api/releases/:version", delete(api::releases::delete_release))
 
+        // Changelog (no auth - public, like /api/version)
+        // Single route: version == "latest" selects the latest file; axum 0.7 / matchit 0.7
+        // panics if a static segment and a path param share this position, so do not split it.
+        .route("/api/changelog/:component/:version", get(api::changelog::get))
+
         // Agent downloads (no auth - public download links)
         .route("/api/download/viewer", get(api::downloads::download_viewer))
         .route("/api/download/support", get(api::downloads::download_support))