docs/ci: automate CHANGELOG updates and retroactively document post-v0.5.0 changes

- Fix semantic-release autoescape=true Jinja2 bug preventing CHANGELOG generation
- Add explicit changelog_file, mode=update, output_format=md to pyproject.toml
- Add fallback semantic-release changelog step in release.yml
- Manually true up CHANGELOG.md with comprehensive v0.40.0 retroactive entry covering
  all post-v0.5.0 additions: security middleware, 6 new storage providers, PDF processing
  improvements, dual-table status tracking, notification system, admin file manager,
  browser extension v1.1, path traversal fixes, and documentation additions
- Add Documentation-First Development section to CONTRIBUTING.md and AGENTIC_CODING.md
- Fix README.md quick-start commands and screenshots note
- Update TODO.md to reflect current version and completed tasks"

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

pyproject.toml

@@ -49,7 +49,8 @@ match = "main"
 prerelease = false
 
 [tool.semantic_release.changelog]
-template_dir = "templates"
+changelog_file = "CHANGELOG.md"
+mode = "update"
 exclude_commit_patterns = [
     "^chore\\(release\\):",
     "^Merge",
@@ -58,6 +59,7 @@ exclude_commit_patterns = [
 
 [tool.semantic_release.changelog.default_templates]
 changelog_file = "CHANGELOG.md"
+output_format = "md"
 
 [tool.semantic_release.changelog.environment]
 block_start_string = "{%"
@@ -71,7 +73,7 @@ lstrip_blocks = false
 newline_sequence = "\n"
 keep_trailing_newline = false
 extensions = []
-autoescape = true
+autoescape = false
 
 [tool.semantic_release.commit_parser_options]
 allowed_tags = [