Add CHANGELOG and launch validation checklist

CHANGELOG.md follows Keep-a-Changelog. The Unreleased section
sits at the top; the v0.1.0 entry summarises every commit on
the path from the empty fork to a hosted multi-tenant build:
fork + restructure, storage/auth/tenant/httpapi packages, the
serve command, full frontend (landing, login, verify, app shell,
PWA, sync), Docker + deploy + backup tooling, docs, and the
community infrastructure. Two known-incomplete items called out
explicitly: the upstream Notesium UI is not yet wired into the
multi-tenant shell, and SMTP delivery has only been exercised
against the LogMailer.

docs/launch-checklist.md is the manual QA pass for v0.1.0:
environment prerequisites, the full sign-up to first-note flow
on Chrome / Firefox / iOS Safari / Android Chrome (with explicit
PWA-install and offline-shell verifications), documentation
accuracy spot-checks, the community-infra render checks, and a
backup-and-restore round-trip on the staging host. The QA
performer signs off at the bottom; failures are filed as
separate bugs against the milestone.

The actual v0.1.0 tag will be cut by a maintainer; tagging is
not part of this commit.

Refs #30 and #33.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/launch-checklist.md

@@ -0,0 +1,88 @@
+# Launch validation checklist
+
+Manual QA pass for v0.1.0. Performed on a staging environment
+that mirrors production (Docker Compose with the prod overrides,
+real SMTP, public DNS + TLS termination).
+
+The goal is to convince yourself a brand-new user can go from
+landing page to first note without confusion, and that a
+contributor can file an issue or open a PR through the templates.
+
+## Environment
+
+- [ ] Staging URL reachable over HTTPS.
+- [ ] `LIBRENOTES_BASE_URL` matches the staging URL exactly.
+- [ ] SMTP credentials valid; test send to a real inbox succeeds.
+- [ ] `/healthz` returns 200 from outside the Docker network.
+
+## End-user flow
+
+### Desktop — Chrome
+
+- [ ] Landing page (`/`) loads and renders correctly.
+- [ ] All links in the header and footer work.
+- [ ] "Sign in with email" → `/login.html`.
+- [ ] Submit a never-before-seen address → success state shows.
+- [ ] Magic-link email arrives within 30s.
+- [ ] Click link → `/verify.html` → "Go to your notes".
+- [ ] Token is stripped from the address bar after verification.
+- [ ] App shell shows email + sync badge transitions to
+      "synced" within a few seconds.
+- [ ] Onboarding dialog appears.
+- [ ] Welcome note exists in the notebook.
+- [ ] Dismissing the dialog does not reopen on reload.
+- [ ] Theme toggle persists across reload.
+- [ ] Sign out clears session and tenant store; signing back
+      in does NOT show onboarding again (same device, same
+      tenant).
+
+### Desktop — Firefox
+
+- [ ] Repeat the same flow with no console errors specific to
+      Firefox.
+
+### Mobile — iOS Safari
+
+- [ ] Layout has no horizontal scroll on iPhone SE (320px).
+- [ ] Touch handles for any interactive controls respond
+      without ghost clicks.
+- [ ] PWA installable via "Add to Home Screen".
+
+### Mobile — Android Chrome
+
+- [ ] beforeinstallprompt surfaces the install button.
+- [ ] Installed PWA opens in standalone mode.
+- [ ] Offline: open the app with airplane mode on; the shell
+      renders and the welcome note loads from IndexedDB.
+
+## Documentation
+
+- [ ] User guide accurate (reflects current behaviour).
+- [ ] Self-hosting guide produces a working stack on a fresh
+      Debian box (re-run quick-start).
+- [ ] API reference matches actual responses for /auth and
+      /api/notes.
+- [ ] CONTRIBUTING dev-setup section runs to a green
+      `make test` from a fresh clone.
+
+## Community infrastructure
+
+- [ ] "New issue" page shows two templates (bug, feature).
+- [ ] Bug template's required fields actually require input.
+- [ ] PR template renders on the new-PR form.
+- [ ] CoC reachable from the README.
+
+## Backup & restore
+
+- [ ] `scripts/backup.sh` produces an archive on the staging
+      host.
+- [ ] `scripts/backup-restore-test.sh` passes against that
+      archive.
+- [ ] Retention prune leaves the right number of files.
+
+## Sign-off
+
+- [ ] All checked. Any failures filed as separate bug reports
+      against the v0.1.0 milestone.
+- [ ] QA performer: ____________________
+- [ ] Date (UTC): ____________________