Sync the self-hosting stack

CHANGELOG.md

@@ -9,6 +9,34 @@ one of them changed. An entry says which artefact and which version, so `web 0.1
 Every version published to a channel appears here. Nothing is written from memory afterwards: a build
 cannot be published without its entry.
 
+## 2026-10-21 — The last TypeScript release `api 0.151.0` `web 0.185.0`
+
+**The last release of the TypeScript api and console, and the one to be on before api 1.0.0** —
+Jarvis rewritten on .NET — which starts only on a database api 0.149.0 or later has migrated. It
+carries the fixes found while rewriting Jarvis, and no new feature.
+
+- **An api that stayed down after an invitation was accepted starts again.** Since api 0.138.0 the
+  upgrade check counted a redeemed invitation as a broken one: from the first acceptance on, every
+  start stopped with `invitation(s) hold no profile … Install api 0.139.1 first`. It no longer does.
+- **A fresh compose install starts again**: the secrets directory exists in the image, owned by the
+  api's user.
+- **On Kubernetes, the api writes to the Redis primary.** `02-config.yaml` now sets its two
+  `REDIS_SENTINEL*` lines, which name what `08-redis-sentinel.yaml` deploys. `REDIS_URL` alone at that
+  file's `redis` Service, the previous default, could land an api pod on a read-only replica: every
+  write it made failed with `READONLY` while its readiness probe stayed green. The web's
+  HorizontalPodAutoscaler moved to the last sync wave, so a first Argo sync succeeds.
+- **Security fixes**: revoking a session closes its live connections even when one api pod does not
+  answer; a tenant's Microsoft Graph token is sent to that tenant's Graph endpoint only, and Graph
+  risk is judged on the request's own path; PowerShell commands double every quote character; a
+  diagram exported to SVG keeps only drawing elements; a share link's new expiry applies to the
+  readers it already admitted; a Teams message and an activity notification wait for approval.
+- **The console says when a read was refused or failed**, instead of drawing an empty list or a wrong
+  answer; dialogs stay open while their write runs; actions are offered only to who may take them;
+  refusals read in the reader's language.
+
+Update the API and web images together. No agent update is required, and the schema does not
+change. On Kubernetes, take the new `02-config.yaml`, or set the two `REDIS_SENTINEL*` lines in yours.
+
 ## 2026-10-13 — Organization records take only what they expect `api 0.150.0` `web 0.184.0`
 
 **Each field of an organization's record now checks what it is given.**