Phase 4: best-effort changelog "what's changed" panel

[StrandedTurtle]

The last planned phase — the open → review changes → apply flow.

What's new

• changelog.js resolves release notes for a container's image:
  • if the image's OCI source label points at GitHub, fetch recent releases and show those newer than the running version (heuristic walk from newest until it hits your version, capped at 10);
  • otherwise link out to the source URL, Docker Hub tags, or GHCR repo.
• GET /api/changelog/:name — resolves the container's image + version + source (new docker.getContainerImageMeta) and caches the result per image+version for 10 min (GitHub's anon API is rate-limited).
• Each update card gets a lazy "What's changed" panel: it fetches on expand and renders release notes (as escaped plain text — no markdown/XSS) or a link-out.

Parsing/selection helpers (parseGitHubRepo, selectNewerReleases, buildRegistryLink) are pure and unit-tested; only the GitHub fetch touches the network.

Notes / limits

• Available-version resolution from the registry config blob was deliberately not included (fragile multi-step registry call, untestable here) — the card still shows "newer image" for the target, and the panel shows GitHub releases newer than the running version, which is the useful part.
• Works best for images that publish org.opencontainers.image.source (most modern images do); others get a link-out.

Test plan

• cd server && node --test → 73/73 (added changelog parsing/selection tests)
• cd client && npm run build → clean
• server boots cleanly
• Host: a container whose image exposes a GitHub source shows release notes; one without shows a link-out

---

Generated by Claude Code