docs: cut CHANGELOG 0.6.0, reopen Unreleased

Everything under Unreleased goes out as 0.6.0: the per-delivery page, the
DNS badge in the domain list, the machine metrics card, the section index,
the navigation column, and the layout, brand and import-form changes.
Added entries, hence a minor bump.

The import form reading the file extension instead of an "is it encrypted"
checkbox was never written down; it is added under Changed, together with
the follow-up that keeps the field hidden while no file is chosen.

The heading is the version: there is no constant in the tree, only the
VERSION build arg that ldflags stamps into internal/buildinfo.Version, so
the image this deploys under is tagged from here.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,8 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+## [0.6.0] - 2026-08-08
+
 ### Added
 
 - A page per delivery (`/deliveries/{id}`), reached from the *Details* link on
@@ -131,6 +133,13 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   with the page entries under it, as the full mark already does with the card
   beneath it on the signed-out pages. Where the column lies back down into a
   bar it returns to the compact size, which is what fits beside the entries.
+- The import card reads the file's extension instead of asking whether the file
+  is encrypted. The checkbox was a question the server never consulted — it
+  decides from the envelope's magic bytes — so the answer could only be wrong.
+  Choosing a `.spde` file reveals the password field and a `.json` file hides
+  it; an unrecognised extension reveals it, and with no file chosen the field
+  stays hidden, since there is nothing yet for a password to open. With
+  JavaScript blocked the field is shown, so an encrypted import still works.
 
 ## [0.5.0] - 2026-08-06