release: 1.0.0, a changelog, one .env.example and the docs to match

- CHANGELOG.md and CHANGELOG.pt-BR.md, from the project history.
- .env.example now serves development and production; scripts/init-env.sh
  (make env) creates .env with random secrets. .env.production.example is gone.
- docs/RELEASING.md: the pipeline, how a version is cut and deployed, the runners.
- DEPLOYMENT.md and both READMEs updated for Gitea and the new env flow.
- Service versions set to 1.0.0.
- CI: the proxy network step is idempotent and the stack is torn down always,
  since the runner's Docker daemon now outlives a job.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -0,0 +1,105 @@
+# Changelog
+
+All notable changes to LambdaMail are listed here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project follows
+[Semantic Versioning](https://semver.org/).
+
+[Português](CHANGELOG.pt-BR.md)
+
+## [Unreleased]
+
+## [1.0.0] - 2026-10-30
+
+The first tagged release. Earlier work was never tagged, so this entry sums up
+everything from the first commit on 2026-07-23 to the move to Gitea. Gaps that
+remain are listed in the README under
+[What is not finished](README.md#what-is-not-finished).
+
+### Mail server
+
+- SMTP MX and Submission (587 STARTTLS, 465 implicit TLS), IMAP with UID, flags,
+  IDLE, CONDSTORE, `SEARCH`, `EXPUNGE`, `COPY` and `MOVE`, POP3 and ManageSieve.
+- SPF, DKIM (Ed25519 and RSA dual signature), DMARC, ARC sealing, MTA-STS and
+  DANE on delivery, and TLS-RPT report ingestion.
+- Rspamd scoring with greylisting, RBLs and rate limiting, and ClamAV.
+- A durable outbound queue in Postgres with the retry ladder and RFC 3464
+  bounces, a smarthost fallback for hosts with port 25 blocked, and a
+  configurable SPF term for the relay (`RELAY_SPF_INCLUDE`).
+- Mail addressed to this server is delivered locally instead of going out to the
+  internet and back.
+- Every submitted message is kept in the sender's Sent folder; app passwords
+  sign in over SMTP, IMAP and POP3.
+- Sieve rules evaluated at delivery, custom folders, and an RFC 5230 vacation
+  responder that replies in thread and once per sender per week.
+
+### Webmail and console
+
+- A complete redesign of both surfaces (the "Nocturne" interface): dark and light
+  themes, a command menu on `Ctrl K` / `Cmd K`, `c` and `/` shortcuts, an
+  installable app with its own icon, and a drawn logo.
+- Conversations in cascade, with who wrote, how many, and whether you have
+  answered; reply, reply all, important mail, undo send, and drafts that replace
+  the previous autosave.
+- A reader that suits both themes: plain messages take the app's colours,
+  designed ones keep their white sheet, quoted history folds away, remote images
+  are blocked until allowed.
+- Trusted senders, kept on the server per mailbox: their mail skips spam and
+  always shows images.
+- Webmail sessions of 30 days that renew while used, several accounts signed in
+  at once and switchable from the sidebar; the console stays at 8 hours.
+- Profile photos with a circular crop editor, and per-domain BIMI logo hosting
+  and validation, published to DNS and kept in step with the logo.
+- Admin console with server-side paging and filtering, user editing (role,
+  quota, language, password, second factor), aliases, a diagnostics page, and
+  isolation between the user and admin surfaces. Domain admins are confined to
+  their own domain.
+- English, Portuguese and Spanish, with a test that every string exists
+  in all of them.
+
+### DNS and TLS
+
+- Cloudflare reconciliation of the expected records for every active domain,
+  idempotent, with per-record verification against public resolvers; a DKIM
+  record is never published with an empty key.
+- A TLS panel that states the digest the TLSA record must carry, and documented
+  steps for turning DANE on. `TLS_MODE=traefik` (default) or `acme`.
+
+### Security
+
+- Two-factor sign-in with TOTP and recovery codes; enrolment can no longer
+  replace a secret the authenticator already has, enable MFA without recovery
+  codes, or kill the auth service. `make reset-mfa` recovers a broken enrolment.
+- Argon2 concurrency is bounded, so a login flood cannot take the auth service
+  down.
+- All service containers run as non-root; images are scanned with Trivy and the
+  build fails on HIGH or CRITICAL findings.
+- Dependencies updated for two published advisories: `next` 15.5.28
+  (unauthenticated remote code execution in image optimisation,
+  GHSA-2464-fhr4-w9xw) and `go-jose` 4.1.6 (denial of service).
+
+### Deployment and CI
+
+- The deploy host pulls images that CI built and tested; nothing is compiled on
+  the server. The compose file pins Traefik to the proxy network by name.
+- **Moved to Gitea.** The source, the workflows (`.gitea/workflows`) and the
+  container images now live on `git.lucasrguerra.dev.br`; the images are
+  published for `linux/amd64` and `linux/arm64` under
+  `git.lucasrguerra.dev.br/lucasrguerra/lambdamail/<service>` and the `v*` tag
+  creates a release with notes. See [docs/RELEASING.md](docs/RELEASING.md).
+- CI caches npm, Go modules, the embedded Postgres, Trivy's database and image
+  layers.
+- One `.env.example` for development and production, and `scripts/init-env.sh`
+  to create `.env` with random secrets (`make env`). It replaces
+  `.env.production.example`.
+
+### Fixed
+
+- Webmail healthcheck: Next binds IPv4 only and `wget` resolved `localhost` to
+  `::1`.
+- The admin lockout, a draft that did not discard, folder counters, a vacation
+  reply that was not a reply, DNS panels that reported published records as
+  missing, and the reconcile button that created nothing.
+- Migrations: a default partition for `email_messages`.
+
+[Unreleased]: https://git.lucasrguerra.dev.br/lucasrguerra/LambdaMail/compare/v1.0.0...HEAD
+[1.0.0]: https://git.lucasrguerra.dev.br/lucasrguerra/LambdaMail/releases/tag/v1.0.0