docs: add changelog

CHANGELOG.md

@@ -0,0 +1,45 @@
+# Changelog
+
+All notable changes to yedir-ai will be documented in this file.
+
+This project follows a pragmatic changelog format inspired by Keep a Changelog. Dates use ISO format.
+
+## Unreleased
+
+### Added
+
+- Lovart home release smoke script via `pnpm smoke:routes`.
+- Unified local and CI quality gate via `pnpm check:quality`.
+- Release readiness checklist, deployment guide, operations guide, architecture overview, security policy, contribution guide, support policy, code of conduct, PR template, issue templates, CODEOWNERS, and Dependabot configuration.
+- Scoped log hygiene gate for high-risk server/client files.
+- Route-level helper tests for Canvas chat helper behavior.
+
+### Changed
+
+- `/` home now prioritizes a lightweight shell and progressively loads personalized data.
+- `/classic` and `/chat/[id]` legacy UI routes redirect to `/`.
+- `/api/chat` is documented and treated as an internal Canvas/Agent generation API.
+- Admin settings local AI sections were modularized into focused components with shared section shells and types.
+- Lovart home and Canvas/ImageNode presentation surfaces were split into more focused modules.
+- Chat API internals were partially extracted into focused `_lib` helpers.
+- CI now reuses the same quality gate command as local development.
+
+### Security
+
+- Production logging now uses structured redaction for storage/upload, auth, AI provider, Canvas, scene fusion, Pick Object, Tripo 3D, World Labs, and internal generation paths.
+- Sensitive values such as tokens, cookies, Authorization headers, signed URLs, base64 payloads, prompts, provider responses, and private user content are documented as non-loggable/non-shareable.
+- Tracked local artifact checks prevent `.env.local`, `.DS_Store`, swap files, `.claude/`, migration backups, and `tsconfig.tsbuildinfo` from entering Git.
+- Security disclosure guidance is documented in `SECURITY.md`.
+
+### Verification
+
+- Current local release checks:
+  - `pnpm check:quality`
+  - `AUTH_TRUST_HOST=true PORT=3001 pnpm dev`
+  - `SMOKE_BASE_URL=http://127.0.0.1:3001 pnpm smoke:routes`
+
+### Known Follow-ups
+
+- Confirm remote GitHub Actions on a pushed PR.
+- Continue optional log hygiene coverage for remaining historical image enhancement interfaces.
+- Continue optional modularization of large Canvas/Agent historical modules.

README.md

@@ -115,6 +115,7 @@ tests/                       Playwright e2e and route-level tests
 - [贡献指南](CONTRIBUTING.md)
 - [行为准则](CODE_OF_CONDUCT.md)
 - [支持说明](SUPPORT.md)
+- [更新日志](CHANGELOG.md)
 
 ## 开发边界