docs(changelog): add missing Unreleased entries

[lfnovo]

Summary

Catches the [Unreleased] section of the CHANGELOG up with everything merged since v1.10.0 that wasn't yet recorded, in preparation for cutting v1.11.0:

• Security: the July hardening batch — SurrealQL injection fixes (fix: prevent SurrealQL injection in repo_relate/repo_upsert/repo_update #1002, fix: prevent SurrealQL injection in Credential.get_all()'s order_by #1021), constant-time password comparison (fix: use constant-time comparison for the API password #1003), Jinja2 prompt compilation (fix: stop compiling user-controlled prompts as Jinja2 template source #1004), SSRF protection + request-time URL re-validation (fix: add SSRF protection to source-URL ingestion #1005, fix: re-validate provider-credential URLs at request time, not just save time #1006), markdown preview sanitization (fix: sanitize raw HTML in the note/transformation markdown preview #1007), Vertex filesystem oracle (fix: don't leak filesystem info via Vertex credential test errors #1012), CORS wildcard/credentials (fix: don't combine wildcard CORS origins with allow_credentials #1013), request body cap (fix: reject oversized request bodies before auth/routing #1014), upload path hardening (fix: harden source upload path handling and cap array inputs #1015), error message sanitization (fix: don't leak internal exception text in API error responses #1017), Host/X-Forwarded-Proto validation (fix: validate Host/X-Forwarded-Proto before trusting them for API URL #1024), SurrealDB port binding (fix: bind SurrealDB's docker-compose port to localhost only #1025)
• Added: sources table sorting ([Future Enhancement] Add sorting for all columns in Sources list #895), EasyPanel template + install guide ([Feature]: Create EasyPanel Templates #189), CI coverage measurement (test(ci): measure and report test coverage #942)
• Fixed: SSE streaming through the Next.js proxy (fix: stream SSE responses end-to-end through Next.js proxy #770), insight/job-status batching (fix: batch source-insight lookups when building notebook/chat context #1008, fix: contain podcast audio paths and batch job-status lookups #1018), event-loop fixes for uploads and DNS (fix: run file upload writes off the event loop #1009, fix: make validate_url() async so DNS resolution doesn't block the event loop #1011), provider allowlist 422 (fix: restrict CreateCredentialRequest.provider to a known allowlist #1016), silent embed-queue failures (fix: surface silent command-submission failures where they matter #1019); appended the deprecated-gemini cleanup (fix: remove deprecated gemini models #1027) to the existing [Bug]: Google AI connection test checks for removed gemini-2.0-flash #970 entry
• Changed: default-password docs correction + dead auth helper removal (chore: remove dead auth helper and fix stale default-password docs #1026)

Entries follow the existing convention: issue number when one exists, PR number otherwise.

Testing

Docs-only change; verified every merged PR since v1.10.0 is now represented in [Unreleased].

[cubic-dev-ai]

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}