Fix indentation in wallet providers, add 2.4.0 changelog

- Fixed indentation error in coinbase_paymaster.py from comment addition
- Added build-time secrets documentation to CLAUDE.md
- Added 2.4.0 changelog entry

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: emooreatx

CHANGELOG.md

@@ -5,6 +5,23 @@ All notable changes to CIRIS Agent will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.4.0] - 2026-04-07
+
+### Added
+
+- **Bengali Localization** - Full Bengali (bn) language support across all localization files and backend validation
+- **Language Coverage Analysis** - New `localization/CLAUDE.md` with expansion roadmap and coverage analysis
+- **Localization Manifest** - Enhanced `localization/manifest.json` with per-language metadata (speaker counts, regions, script info)
+
+### Fixed
+
+- **Observer Login Scope** - Changed observer login blocking to only apply on mobile platforms (Android/iOS), allowing OBSERVER OAuth logins on standalone API servers where read-only access is valid
+- **HA Adapter Wizard** - Fixed 401 error during first-time Home Assistant adapter setup by checking session auth before requiring token
+
+### Changed
+
+- **Build-Time Secrets Documentation** - Added guidance in CLAUDE.md about `# type: ignore[import-not-found]` comments for generated files
+
 ## [2.3.7] - 2026-04-06
 
 ### Fixed

CLAUDE.md

@@ -190,6 +190,18 @@ grep -r "class.*YourThingHere" --include="*.py"
    - Minimal Dict[str, Any] usage remaining, none in critical code paths
    - Run mypy as part of CI/CD pipeline
 
+7. **Build-Time Generated Files**
+   - Some files are generated at build time and not present in the repo/CI
+   - These require `# type: ignore[import-not-found]` comments
+   - **DO NOT REMOVE** these comments even if mypy reports "unused-ignore" locally
+   - Examples:
+     - `ciris_adapters/wallet/providers/_build_secrets.py` - Contains API keys/URLs injected at build time
+   - Always add a comment explaining why the ignore is needed:
+     ```python
+     # _build_secrets is generated at build time, not present in CI/repo
+     from ._build_secrets import get_api_key  # type: ignore[import-not-found]
+     ```
+
 ## CRITICAL: OAuth Callback URL Format
 
 **PRODUCTION OAuth CALLBACK URL - DO NOT FORGET:**

ciris_adapters/wallet/providers/coinbase_paymaster.py

@@ -91,6 +91,7 @@ def __init__(self, config: CoinbasePaymasterConfig):
     def _load_build_time_secret(self) -> None:
         """Load Coinbase paymaster URL from build-time secrets if available."""
         try:
+            # _build_secrets is generated at build time, not present in CI/repo
             from ._build_secrets import get_coinbase_paymaster_url  # type: ignore[import-not-found]
 
             url: Optional[str] = get_coinbase_paymaster_url()

ciris_adapters/wallet/providers/x402_provider.py

@@ -275,6 +275,7 @@ def _get_arka_api_key(self) -> Optional[str]:
         """
         # Try build-time secret first (Android release builds)
         try:
+            # _build_secrets is generated at build time, not present in CI/repo
             from ._build_secrets import get_arka_api_key  # type: ignore[import-not-found]
 
             key: Optional[str] = get_arka_api_key()