docs(changelog): record T-1 — caller auth, locked housekeeping reads, the Book

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Added
+
+- **Caller auth** (`src/domains/auth/callers.py`) - the first thing in this repo
+  that reads a service key. `require_caller()` resolves a static office/tatlock/
+  scheduler key (constant-time compare, checked before any JWT parsing) or falls
+  through to the existing OIDC path. New settings: `office_service_key`,
+  `tatlock_service_key`, `scheduler_service_key`, `book_timezone`.
+- **The Book** (`src/domains/book/`) - Notes, Tasks, Decisions, Questions and
+  Rejected options (workspace D-68/D-69/D-70). Routes: `add`, `show`, `list`,
+  `find`, `change`, `close`, `link`/`unlink`, `tag`/`untag`, `history`, all under
+  `/book/*`, behind `require_caller("office", "user")`. Migration 005 creates the
+  whole schema: `book_records`, `book_tags`, `book_record_links`,
+  `book_attachments`, `book_events` (append-only, DB trigger-enforced).
+
+### Changed
+
+- **Housekeeping reads are locked** - `GET /housekeeping/*` (health, devices,
+  areas, scenes, scripts, automations, history) now require a caller
+  (`office`, `tatlock`, or `user`) instead of being unauthenticated. Writes are
+  unchanged (`get_admin_user`). `api.schweitz.net` carries no forward-auth, so
+  this was an open read of the house's device list once Home Assistant's token
+  is restored (T-1 / D-68).
+
 ## [1.11.0] - 2026-01-08
 
 ### Added