Sync the self-hosting stack

CHANGELOG.md

@@ -9,6 +9,27 @@ one of them changed. An entry says which artefact and which version, so `web 0.1
 Every version published to a channel appears here. Nothing is written from memory afterwards: a build
 cannot be published without its entry.
 
+## 2026-10-07 — Consent profiles for workstations, infrastructure and shared servers `api 0.120.0` `web 0.148.0` `agent 0.32.0`
+
+Choose a remote-desktop access profile by how a machine is used, independently of its Windows
+edition. The organization supplies the default; an administrator can override it per machine.
+Existing consent settings stay in force until a profile is chosen.
+
+**User workstation** asks before sharing an occupied user session. **Infrastructure server** opens
+administrative access immediately with the visible notice. **Shared server / RDS** separates
+**Administer the server** from **Assist a user**: direct administration targets the empty console
+or an explicitly authorized Windows account; assisting an occupied session asks for its consent.
+The connection screen names the target account and explains whether approval is needed.
+
+The agent checks the current Windows account and logon before capture and input, so a session
+identifier reused by another user cannot inherit an earlier agreement. After a technical connection
+loss, the same operator may reuse acknowledged user consent for up to 60 seconds, for the same
+Windows logon and unchanged policy. An explicit close, a different account or an expired agreement
+requires a fresh decision. Access and consent provenance remain recorded.
+
+Update the API, web console and agent release image. The API applies an additive schema update;
+existing policies and records are preserved. Configured profiles require agent 0.32.0 or later.
+
 ## 2026-10-07 — Accurate remote-desktop consent status and countdown `api 0.119.2` `agent 0.31.3`
 
 While remote-desktop permission is waiting for an answer, Windows shows only the consent prompt.