docs: add CHANGELOG.md, trim completed work out of plan/progress

CHANGELOG.md now tracks version history (0.1.0 baseline); progress.md and
implementation-plan.md keep only live process and unfinished work (open
questions, optional 2.x.x phase O1) since phases 0-11 are fully closed and
already covered by git history and the changelog.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -0,0 +1,44 @@
+# Changelog
+
+All notable changes to this project are documented here.
+Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versioning follows [SemVer](https://semver.org/).
+
+## [Unreleased]
+
+- ci: disable provenance attestation on release image push, so the ghcr.io
+  manifest list shows only `linux/amd64`/`linux/arm64` (no `unknown/unknown`).
+
+## [0.1.0] - 2026-07-15
+
+Initial feature-complete implementation of the v1.0 specification (phases 0-11
+of `docs/implementation-plan.md`).
+
+### Added
+
+- Panel (Go, single static binary) with SQLite persistence, one-time
+  crypto-random setup link, bcrypt admin auth, session cookies.
+- Domain management with per-domain DKIM (RSA-2048, generated in pure Go) and
+  OpenDKIM KeyTable/SigningTable regeneration + privilege-safe reload.
+- Application (sender identity) management: SASL credentials via `sasldb2`,
+  `smtpd_sender_login_maps` enforcing sender/domain ownership, no open relay.
+- Full Postfix relay config generated from env at container start: SMTPS 465,
+  optional STARTTLS submission 587, SASL auth, TLS for outbound delivery,
+  anvil-based rate limiting (level 1).
+- Journal milter (pure Go, `go-milter`) recording every send to `send_log`;
+  fail-open by design so a milter fault never blocks mail.
+- Monitoring UI: send log, Postfix queue, and mail.log tail, all
+  HTMX-polling, HTML-escaped.
+- Per-domain/per-application sending rate limit (level 2), enforced in the
+  journal milter at `MAIL FROM`, fail-open on the limiter's own errors.
+- Full backup/restore (`tar.gz` of `/data`, consistent SQLite snapshot via
+  `VACUUM INTO`) with a version guard that refuses to start on a
+  manifest/binary version mismatch. Per-domain export/import for moving a
+  single domain between hosts without re-issuing DNS records.
+- Deployment: Docker image + compose, reverse-proxy fragments for Apache
+  (default), nginx, Caddy, and Traefik; CI workflow publishing tagged,
+  multi-arch images to `ghcr.io` on `vX.Y.Z` tags.
+- Security pass against spec 7.6 (exec safety, config-write sanitization,
+  server-side validation, rate limiting, session/cookie hardening, output
+  escaping, non-root panel) — full compliance, no code changes required.
+- Live production deployment on `selfpost.mixfed.ru` with a real Let's
+  Encrypt certificate; end-to-end delivery confirmed (DKIM pass, SPF pass).