Add CHANGELOG.md documenting all changes so far

CHANGELOG.md

@@ -0,0 +1,25 @@
+# Changelog
+
+All notable changes to this project are logged here, newest first. This file starts from the point the toolkit was handed off and set up in this repo.
+
+## 2026-08-24
+
+- Fixed: every delete action now shows a confirmation before it deletes. Replaced the browser's plain `confirm()` popup with a custom on-brand modal (a card with a red left accent, matching the app's existing "attention" styling, on a dimmed backdrop). Covers cluster delete, issue delete, breadcrumb delete, action delete, scope item delete, priority-rank item delete, decision delete, and both Reset buttons. Several of these had no confirmation at all before this change.
+- Fixed: the new breadcrumb list was rendering as single-character vertical columns instead of a normal list. Cause: the list used a `<nav>` tag, which collided with the app's existing `nav{display:flex}` rule written for the top tab bar. Changed the element to a `<div>`.
+- Fixed: the app was capped at `max-width:1500px` and centered, wasting space on wide screens. Removed the cap so the app fills the browser width.
+- Changed: redesigned the Breadcrumbs panel in the Field Problem Workshop tool. Previously every breadcrumb card showed all 7 fields fully expanded at once, for every breadcrumb, all the time. Replaced with a list-plus-detail split view: a compact status-dot list on the left, the full field editor for one selected breadcrumb on the right.
+
+## 2026-08-21
+
+- Added: `UNIFIED_TOOL_ROADMAP.md`, a design and phased-rollout plan for eventually merging the Field Problem Workshop and the Scope Lock Meeting Suite onto one backend with a shared database. Planning only; not built.
+- Changed: turned the per-user daily token quota off by default (`TOKEN_LIMIT_PER_USER=0`). A cost analysis against the tool's own baseline usage showed real spend at stake was small enough that the quota wasn't worth the added complexity yet. The code stays in place and can be re-enabled with one setting.
+- Added: a per-user daily token quota (`TOKEN_LIMIT_PER_USER`), tracked per named user in `APP_USERS` and persisted to `data/token-usage.json`, mounted as a Docker volume so usage survives a container restart.
+- Added: `MOCK_AI` mode. Set `MOCK_AI=true` to test the AI draft button, the login gate, and the token quota with a canned response, no API key and no cost.
+
+## 2026-08-20
+
+- Added: `DOCKER_TESTING.md`, a step-by-step guide for standing up and testing the Docker environment.
+- Added: a shared login gate (`APP_USERS`, or legacy `APP_USERNAME`/`APP_PASSWORD`) and per-IP rate limiting (`RATE_LIMIT_MAX` / `RATE_LIMIT_WINDOW_MS`) ahead of running this for the whole company on the internal network.
+- Added: `Dockerfile`, `.dockerignore`, `docker-compose.yml` to containerize the toolkit, so it can run standalone or alongside the Work Package Suite container.
+- Fixed: the AI draft button returned "Failed to fetch." Cause: it called the Anthropic API directly from the browser with no key, which the browser's CORS policy blocks. Added `server.js`, a local Node server that serves the two tools and proxies `/api/claude` to Anthropic server-side, so the API key never reaches the browser. Updated the button in `field-problem-workshop.html` to call `/api/claude` instead of `api.anthropic.com` directly.
+- Added: initial import of the toolkit into this Git repository — `README.md`, `QUICKSTART.md`, `package.json`, `.gitignore`, the two tool files under `tools/`, and the breadcrumb-methodology skill under `skills/`.