Sync the self-hosting stack

CHANGELOG.md

@@ -9,6 +9,34 @@ one of them changed. An entry says which artefact and which version, so `web 0.1
 Every version published to a channel appears here. Nothing is written from memory afterwards: a build
 cannot be published without its entry.
 
+## 2026-10-13 — The old access columns are removed `api 0.147.0`
+
+**This release deletes data on purpose, once, and asks you to confirm it.** It removes what the old
+access model left in the database after `api 0.138.0` translated it into roles: the role word on
+each membership and invitation, the role definitions table, the shell and screen switches on the
+assistant's grants, and the credential grant table. It also removes the setting that named the
+service provider's organization. Nothing has read any of them since `api 0.146.0`, so nothing you
+see changes.
+
+**Before you update**, your instance must be running `api 0.146.0` or later. On a cluster, this
+update must not roll out over pods older than that: they still ask for the columns, and would fail
+while it rolls. An instance that never ran `api 0.138.0` or later is refused before anything changes,
+and told to install `api 0.139.1` first. The accounts that worked for the service provider's
+organization are given it as their primary organization before the setting goes, if an earlier
+update has not already done so.
+
+**To apply it**, set `SCHEMA_ACCEPT_DATA_LOSS=true` for this one update, then remove it:
+
+- **docker compose** — put it in `.env`, `docker compose up -d`, then take it out again.
+- **Kubernetes** — set it on the `jarvis-migrate` Job for this sync, then remove it.
+
+Without it, the migration stops before changing anything and lists what it would drop: exactly the
+columns and tables above, and nothing else.
+
+**After it, no rollback below `api 0.146.0` works**: older builds expect the removed columns.
+
+Update the API image. No web or agent update is required.
+
 ## 2026-10-13 — The service provider setting leaves the API `api 0.146.0`
 
 **Nothing changes on screen.** The API no longer knows the setting that named the service