feat: release-awareness — update banner + changelog page

[vhervatin]

What

Adds two related, opt-in features around Paca releases:

• Update banner on the home screen — appears when a newer release exists.
• "What's New" changelog page (under Administration) — lists recent releases with their notes.

Why

Self-hosters currently have no in-app way to know a new Paca version shipped, or what changed in it. This surfaces both without leaving the app.

Changes

• Backend: public GET /api/v1/version and GET /api/v1/releases, backed by a best-effort GitHub Releases client with Valkey caching. New ReleaseConfig, env-driven with safe defaults: PACA_VERSION (default dev), RELEASE_UPSTREAM_REPO (default Paca-AI/paca), RELEASE_FORK_REPO (default empty), plus cache TTL and timeout.
• Frontend: UpdateBanner on the home screen; a changelog page under Administration (sidebar item "What's New"); version-api / changelog-api query hooks.
• i18n: new keys (home.updateBanner, nav.changelog, admin.changelog) across all 9 locales.

Behavior / scope

• English stays the default; no change to existing flows.
• Best-effort: if the GitHub API is unreachable or rate-limited, the banner simply doesn't render and the page lists nothing — no errors are surfaced to the user.
• PACA_VERSION defaults to dev (unparseable), so the banner never shows on unversioned builds.
• The changelog page is a normal Administration route; it adds no new permission requirements.

Testing

• go build ./... passes; frontend tsc -b --noEmit passes.
• i18n feature keys have full parity across the 9 locales.
• Verified locally: banner shows when the running version is older than the latest release; the changelog page renders release notes and flags the running version; endpoints degrade gracefully (200 with empty payload) when GitHub is unreachable.

🤖 Generated with Claude Code

[pullfrog]

Important

Two things to address before merging: link URLs in the changelog renderer should be restricted to safe schemes, and the new release-check environment variables should be documented in services/api/.env.example.

Reviewed changes — adds a dismissible home-screen update banner and an Administration "What's New" changelog page, backed by new public /api/v1/version and /api/v1/releases endpoints that cache GitHub releases in Valkey.

• Add VersionHandler and public /api/v1/version + /api/v1/releases routes — queries GitHub releases for an upstream repo and optional fork, caches results, and performs lenient semver comparison for update detection.
• Add UpdateBanner to the home screen — conditionally rendered when an update is available and dismissible per release set via localStorage.
• Add /admin/changelog route and page — lists recent releases with a minimal custom Markdown renderer.
• Add ReleaseConfig with env-driven defaults — PACA_VERSION, RELEASE_UPSTREAM_REPO, RELEASE_FORK_REPO, RELEASE_CHECK_CACHE_TTL, RELEASE_CHECK_TIMEOUT.
• Add i18n keys across all 9 locales for the banner, navigation, and changelog page.

ℹ️ No automated tests for VersionHandler

The new handler owns version parsing, cache read/write paths, and two GitHub-dependent public endpoints, but it ships without unit or handler tests. A few small tests for parseVersion/isNewer and the cache-miss/cache-hit branches would guard against regressions once release-check behavior becomes load-bearing.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using Kimi K2 (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

Suggested change

	href={m[5]}
	Link URLs from release notes are emitted as `<a href>` values without scheme validation. A compromised GitHub release could include a `javascript:` link that executes in the app's origin when clicked. Restrict rendered links to URLs starting with `http://` or `https://` and fall back to plain text for anything else.

[pullfrog]

Suggested change

	Version: env("PACA_VERSION", "dev"),
	The new release-check env vars (`PACA_VERSION`, `RELEASE_UPSTREAM_REPO`, `RELEASE_FORK_REPO`, `RELEASE_CHECK_CACHE_TTL`, `RELEASE_CHECK_TIMEOUT`) are not documented in `services/api/.env.example` yet. Add them so deployers can discover the defaults and disable checks by setting the repo values to empty.

[pikann]

Thanks for the awesome PR! 🙌

Could you please fix the CI failures and resolve the problems that pullfrog raised? If you're busy, just let me know—I'd be happy to jump in and help out to get this merged. Thanks again!

[vhervatin]

I'm heading out on a trip early tomorrow morning and won't be back until the following Saturday! I'll have to look into it when I get back!

[pikann]

Enjoy your trip! No worries at all. If you'd like me to finish this up, just say the word!
Otherwise, if you handle it when you return, a quick tip: you might want to commit using your GitHub account so you get officially listed as a contributor. Have a wonderful time! ✨