Bump version to 0.5.0 for settings management release

Settings management represents a significant new feature warranting a minor version bump:
- Database-backed configuration with 102 settings
- Fernet encryption for sensitive values
- Setup wizard for first-time installations
- Complete admin UI and REST API
- OAuth admin group support

Version updated: 0.3.3 → 0.5.0

Keep 0.3.3 release notes intact (drag-and-drop feature from main branch).
Add 0.5.0 as new current release with settings features.

Updated files:
- VERSION: 0.5.0
- CHANGELOG.md: Added 0.5.0 release, kept 0.3.3 intact
- MILESTONES.md: Added v0.5.0 section, adjusted future versions
- TODO.md: Updated current version
- ROADMAP.md: Updated current status
- app/config.py: Default version 0.5.0-dev
- docs/BuildMetadata.md: Updated reference
- ANALYSIS_SUMMARY.md: Updated version

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

CHANGELOG.md

@@ -5,6 +5,91 @@ All notable changes to DocuElevate will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+# Changelog
+
+All notable changes to DocuElevate will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.5.0] - 2026-02-08
+
+### Added
+- **Settings Management System**: Database-backed configuration management with web UI
+  - Admin-only settings page at `/settings` with 102 settings across 10 categories
+  - REST API endpoints: `GET/POST /api/settings/{key}`, `POST /api/settings/bulk-update`, `DELETE /api/settings/{key}`
+  - Settings organized by category: Core, Authentication, AI Services, Storage Providers, Email, IMAP, Monitoring, Processing, Notifications, Feature Flags
+  - Form pre-filled with current values, all fields optional for flexible editing
+  - Bulk update support for changing multiple settings at once
+  
+- **Encryption for Sensitive Settings**: Fernet symmetric encryption for database storage
+  - Automatic encryption/decryption for passwords, API keys, tokens, and secrets
+  - Encryption key derived from `SESSION_SECRET` via SHA256
+  - Values prefixed with `enc:` in database to identify encrypted data
+  - Graceful fallback if cryptography library unavailable (logs warning)
+  - Lock icon (🔒) in UI indicates encrypted fields
+  
+- **Setup Wizard**: First-time configuration wizard for fresh installations
+  - 3-step wizard: Infrastructure → Security → AI Services
+  - Auto-detects missing critical settings and redirects from homepage
+  - Beautiful UI with progress indicators and step navigation
+  - Auto-generate option for session secrets
+  - Skippable for advanced users
+  - Settings saved encrypted to database
+  
+- **Settings Precedence System**: Clear resolution order with visual indicators
+  - Precedence: Database > Environment Variables > Defaults
+  - Color-coded badges in UI: 🟢 DB (green), 🔵 ENV (blue), ⚪ DEFAULT (gray)
+  - Source detection for each setting shows where value originates
+  - Info section explaining precedence order
+  
+- **OAuth Admin Support**: Enhanced authentication for settings access
+  - Admin flag set from OAuth group membership (`admin` or `administrators`)
+  - Proper decorator pattern for admin access control
+  - Session-based authorization with redirect on unauthorized access
+
+### Changed
+- Updated `requirements.txt` to include `cryptography>=41.0.0` for encryption
+- Enhanced settings service to auto-encrypt/decrypt sensitive values transparently
+- Improved `/settings` route with proper admin decorator (fixes redirect loop)
+- Updated settings template with enhanced UI: source badges, encryption indicators, show/hide toggles
+- Modified `app/views/general.py` to redirect to wizard when setup required
+
+### Fixed
+- Fixed `/settings` endpoint returning 301 redirect to `/` (converted to proper decorator)
+- Resolved redirect loop for logged-in non-admin users
+- Fixed OAuth users not receiving admin privileges from group membership
+
+### Documentation
+- Added [docs/SettingsManagement.md](docs/SettingsManagement.md) - Comprehensive user guide
+- Added [SETTINGS_IMPLEMENTATION.md](SETTINGS_IMPLEMENTATION.md) - Technical documentation
+- Added [FRAMEWORK_ANALYSIS.md](FRAMEWORK_ANALYSIS.md) - Research on existing frameworks
+- Added [IMPLEMENTATION_CHECKLIST.md](IMPLEMENTATION_CHECKLIST.md) - Feature tracking
+- Updated TODO.md with completed features
+- Updated MILESTONES.md with release details
+
+### Technical Details
+- New files:
+  - `app/utils/encryption.py` - Fernet encryption utilities
+  - `app/utils/setup_wizard.py` - Wizard detection and logic
+  - `app/views/wizard.py` - Wizard routes (GET/POST /setup)
+  - `frontend/templates/setup_wizard.html` - Wizard UI
+  - `frontend/templates/settings.html` - Enhanced settings page
+  
+- Modified files:
+  - `app/utils/settings_service.py` - Encryption integration, 102 setting metadata
+  - `app/views/settings.py` - Fixed decorator, source detection
+  - `app/auth.py` - OAuth admin support
+  - `app/api/settings.py` - Enhanced admin checks
+  - `tests/test_settings.py` - Comprehensive test coverage
+
+### Security
+- Sensitive settings encrypted at rest in database using Fernet (AES-128-CBC + HMAC)
+- Encryption key derived from `SESSION_SECRET` (minimum 32 characters required)
+- Admin-only access enforced on all settings operations
+- Visual masking of sensitive values in UI by default
+- CodeQL security scan: 0 alerts
+
 ## [0.3.3] - 2026-02-08
 
 ### Added
@@ -147,7 +232,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Version History Summary
 
-- **v0.3.3** (2026-02-08): Settings management, encryption, setup wizard
+- **v0.5.0** (2026-02-08): Settings management, encryption, setup wizard
+- **v0.3.3** (2026-02-08): Drag-and-drop upload
 - **v0.3.2** (2026-02-06): Security hardening, testing infrastructure
 - **v0.3.1** (2026-01-15): OAuth2 authentication
 - **v0.3.0** (2026-01-01): Multi-provider storage, OCR, metadata extraction