docs: add v1.6/v1.7 release notes and developer wiki (v1.7.6)

readme.md

@@ -1,4 +1,4 @@
-# ⚡ JarvisChat v1.7.5
+# ⚡ JarvisChat v1.7.6
 
 ![screenshot](docs/images/screenshot.png)
 
@@ -6,6 +6,10 @@
 
 Built with FastAPI + SQLite + Jinja2. Runs on Python 3.13. No Docker required.
 
+Developer wiki: [docs/wiki/Home.md](docs/wiki/Home.md)
+
+Core architecture deep-dive: [docs/wiki/Developer-Architecture.md](docs/wiki/Developer-Architecture.md)
+
 ## Security Scope Disclaimer
 
 JarvisChat is designed for local and home-lab use (same host or trusted LAN).
@@ -20,6 +24,22 @@ If you deploy outside a trusted local subnet, your risk profile changes signific
 
 Use at your own risk. No warranty is provided for Internet-exposed deployments.
 
+## What's New in v1.7.x
+
+- **Security hardening suite completed** - request rate limits, payload caps, settings allowlist, safe error envelopes, and LAN CIDR gate controls
+- **Customer-safe incident handling** - client-facing errors include support-friendly incident keys while full traces remain in server logs
+- **Streaming and regression test expansion** - automated coverage for SSE chat/search paths, memory remember/forget command handling, and auth/guardrail behavior
+- **Skills framework (Phase 1)** - built-in local skill registry with per-skill enable controls, API endpoints, and bounded prompt injection
+- **Skills WebUX controls** - Settings modal now includes a master skills toggle and per-skill toggles for admin users
+
+## What's New in v1.6.x
+
+- **Guest/admin capability split** - guest chat by default with 4-digit admin PIN for advanced or destructive operations
+- **Session + lockout controls** - session lifecycle endpoints, heartbeat, logout/revoke behavior, failed PIN lockout protections, and auth audit events
+- **Browser request protections** - strict origin checks for state-changing requests and admin-only write enforcement
+- **Unsafe link protection** - outbound search links sanitized to allow only http/https absolute URLs
+- **Operational stability fixes** - safer first-boot PIN policy handling and memory-search tokenization fix for punctuation/FTS edge cases
+
 ## What's New in v1.5.0
 
 - **Explicit Web Search Button** — 🔍 button next to SEND forces a web search, bypassing model uncertainty detection