(release) Add Django changelog page

Expose the repository CHANGELOG.md through a staff-only Django view and
link it from the main navigation.

Render a small safe subset of Markdown without adding a runtime dependency,
copy the changelog into the Docker image, and cover the page with view tests.

src/pobsync_backend/tests/test_views.py

@@ -31,6 +31,30 @@ class ViewTests(TestCase):
         self.assertEqual(response.status_code, 302)
         self.assertIn("/admin/login/", response["Location"])
 
+    def test_changelog_requires_staff_login(self) -> None:
+        response = self.client.get(reverse("changelog"))
+
+        self.assertEqual(response.status_code, 302)
+        self.assertIn("/admin/login/", response["Location"])
+
+    def test_changelog_renders_repository_changelog(self) -> None:
+        self.client.force_login(self.staff_user)
+        with TemporaryDirectory() as tmp:
+            changelog = Path(tmp) / "CHANGELOG.md"
+            changelog.write_text(
+                "# Changelog\n\n## 1.0.0 - 2026-05-21\n\n- Django control panel\n- Native systemd installer\n",
+                encoding="utf-8",
+            )
+
+            with override_settings(BASE_DIR=Path(tmp)):
+                response = self.client.get(reverse("changelog"))
+
+        self.assertEqual(response.status_code, 200)
+        self.assertContains(response, "Installed version:")
+        self.assertContains(response, "1.0.0 - 2026-05-21")
+        self.assertContains(response, "Django control panel")
+        self.assertContains(response, "Native systemd installer")
+
     def test_dashboard_renders_hosts_and_latest_runs(self) -> None:
         self.client.force_login(self.staff_user)
         host = HostConfig.objects.create(host="web-01", address="web-01.example.test")