fix: close SSRF/rebinding, IDOR, and stale-session authz gaps found in audit

Bump to 0.5.1. Fixes: unfollowed-redirect SSRF + DNS-rebinding in AI
url-import and webhook dispatch (new safeFetch with IP-pinned undici
dispatcher); cross-user photo deletion via unvalidated recipe/review
storage keys; comment-moderation and tier-quota checks trusting a
stale cached session role/tier instead of the DB.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/components/shared/changelog-list.tsx

@@ -32,6 +32,15 @@ export function ChangelogList() {
             </div>
           )}
 
+          {entry.security && entry.security.length > 0 && (
+            <div className="space-y-1.5">
+              <p className="text-xs font-medium uppercase tracking-wide text-muted-foreground">Security</p>
+              <ul className="space-y-1 text-sm list-disc pl-5">
+                {entry.security.map((line, j) => <li key={j}>{line}</li>)}
+              </ul>
+            </div>
+          )}
+
           {i < CHANGELOG.length - 1 && <Separator className="mt-6" />}
         </div>
       ))}