docs/ci: automate CHANGELOG updates and retroactively document post-v0.5.0 changes

- Fix semantic-release autoescape=true Jinja2 bug preventing CHANGELOG generation
- Add explicit changelog_file, mode=update, output_format=md to pyproject.toml
- Add fallback semantic-release changelog step in release.yml
- Manually true up CHANGELOG.md with comprehensive v0.40.0 retroactive entry covering
  all post-v0.5.0 additions: security middleware, 6 new storage providers, PDF processing
  improvements, dual-table status tracking, notification system, admin file manager,
  browser extension v1.1, path traversal fixes, and documentation additions
- Add Documentation-First Development section to CONTRIBUTING.md and AGENTIC_CODING.md
- Fix README.md quick-start commands and screenshots note
- Update TODO.md to reflect current version and completed tasks"

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

.github/workflows/release.yml

@@ -49,6 +49,21 @@ jobs:
           semantic-release version
           semantic-release publish
 
+      - name: Update changelog if no new version was released
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if git diff --name-only HEAD~1 2>/dev/null | grep -q CHANGELOG.md; then
+            echo "CHANGELOG.md was already updated by semantic-release version"
+          else
+            semantic-release changelog
+            if ! git diff --quiet CHANGELOG.md; then
+              git add CHANGELOG.md
+              git commit -m "docs(changelog): update changelog [skip ci]"
+              git push
+            fi
+          fi
+
       - name: Update build metadata files if changed
         run: |
           for f in VERSION BUILD_DATE GIT_SHA RUNTIME_INFO; do