fix(whats-new): backfill entries for unannounced 0.97.0 features (#1804)

* fix(whats-new): backfill entries for unannounced 0.97.0 features

entries.json shipped empty in the What's New scaffolding (#1767), so the
top-bar icon stayed hidden through the 0.97.0 release despite several
notable features going out. Add entries for the ones that read as genuine
news: SSO-only auth, itemized fleet prune plans, the Audit Log, Fleet
Secrets, ntfy notifications, and the resizable file explorer.

* fix(whats-new): add screenshots to the backfilled entries

Each entry now carries a screenshot captured live against a running
Sencho instance, cropped to the relevant panel. Real usernames, the
client IP, and the real ntfy topic were scrubbed before capture.

frontend/src/whats-new/entries.json

@@ -1 +1,44 @@
-[]
+[
+  {
+    "id": "sso-only-authentication",
+    "title": "SSO-only authentication mode",
+    "blurb": "Require every sign-in on this node to go through your SSO provider instead of a local password. Turn it on once your provider is configured and tested.",
+    "docUrl": "https://docs.sencho.io/features/sso",
+    "screenshot": "sso-only.png"
+  },
+  {
+    "id": "fleet-prune-itemized-plans",
+    "title": "Itemized fleet prune plans",
+    "blurb": "See exactly what a fleet-wide prune will remove, broken down node by node, before you run it. The destructive action stays locked until every reachable node has returned its dry run.",
+    "docUrl": "https://docs.sencho.io/features/fleet-actions",
+    "screenshot": "fleet-prune.png"
+  },
+  {
+    "id": "audit-log",
+    "title": "Audit Log",
+    "blurb": "Every instance ships with an audit log of who did what, and when. Find it under Security & review → Audit.",
+    "docUrl": "https://docs.sencho.io/features/audit-log",
+    "screenshot": "audit-log.png"
+  },
+  {
+    "id": "fleet-secrets",
+    "title": "Fleet Secrets",
+    "blurb": "Share encrypted, fleet-wide environment bundles across your nodes without copying env files by hand.",
+    "docUrl": "https://docs.sencho.io/features/fleet-secrets",
+    "screenshot": "fleet-secrets.png"
+  },
+  {
+    "id": "ntfy-notifications",
+    "title": "ntfy notification channel",
+    "blurb": "Send Sencho alerts straight to ntfy, alongside the channels already supported. Configure it per node under Settings · Notifications · Channels.",
+    "docUrl": "https://docs.sencho.io/features/alerts-notifications",
+    "screenshot": "ntfy.png"
+  },
+  {
+    "id": "resizable-file-explorer",
+    "title": "Resizable file explorer",
+    "blurb": "Drag the divider in the Files tab to give the tree pane more room, or shrink it out of the way. Your preferred width is remembered.",
+    "docUrl": "https://docs.sencho.io/features/stack-file-explorer",
+    "screenshot": "file-explorer.png"
+  }
+]

frontend/src/whats-new/entries.test.ts

@@ -5,8 +5,7 @@ import { isWhatsNewEntry, WHATS_NEW_CAP } from './types';
 // These are authoring guards on the committed data, not tests of behaviour:
 // they fail the build when a hand-written entry is malformed, duplicated, or
 // pushes the file past the cap. The loader's own behaviour is covered in
-// loader.test.ts. While entries.json is still empty they pass trivially, which
-// is expected; they start biting as soon as the first entry lands.
+// loader.test.ts.
 describe('whats-new entries.json', () => {
   it('contains only valid entries', () => {
     for (const entry of rawEntries) {