Stream D: Security hardening — 10 fixes from QA review

- SEC-05: Fail fast if SECRET_KEY is default 'change-me-in-production'
- SEC-06: CORS allow_credentials=False (Bearer tokens don't need it)
- SEC-08: Input validation on auth schemas (min/max length, username pattern)
- SEC-10: .dockerignore files (root, backend, mcp-connector)
- SEC-11: Hardcode ALGORITHM='HS256' as constant, remove from settings
- CQ-01: Gate crawl scheduler on CRAWL_ENABLED env var (default false)
- OS-02: CONTRIBUTING.md
- OS-03: CHANGELOG.md with v1.0.0 entry
- setup.ps1: Add API_TOKEN generation (Windows parity with setup.sh)

CHANGELOG.md

@@ -0,0 +1,27 @@
+# Changelog
+
+All notable changes to Diligence are documented here.
+
+## [1.0.0] — 2026-06-18
+
+Initial open-source release.
+
+### Features
+- Points economy with daily gate, weekly targets, weekly reset
+- Science-based onboarding (PAR-Q+, TTM, BREQ-2 motivation profiling)
+- Activity logging (manual + Strava OAuth + Polar OAuth sync)
+- Food logging with Open Food Facts barcode scanning + USDA FoodData Central
+- 90-day structured program tracking
+- Configurable reward shop
+- In-app support chat with Telegram notifications
+- 14-tool MCP connector for AI agent integration
+- Meal plan system with compliance tracking
+- Dynamic integration configuration (11 providers)
+- B2A discovery layer (llms.txt, agent-card.json, SKILL.md)
+
+### Security
+- Fernet-encrypted credential storage (HKDF key derivation)
+- Signed JWT OAuth state parameters
+- MCP connector authentication via API_TOKEN
+- First-user auto-admin grant
+- Traceback suppression in error responses