fix: MinIO CORS blocking browser uploads, changelog admin-only

- MinIO had no CORS config at all, so the browser's direct PUT to a
  presigned URL (cross-origin: app on :3001/:3000, storage on :9000)
  was blocked outright. Added MINIO_API_CORS_ALLOW_ORIGIN — "*" in
  dev, the app's own origin in prod. Verified end-to-end: photo
  upload now succeeds with zero console errors.
- Removed the public /changelog page and its account-menu link —
  changelog is admin-only now (/admin/changelog).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/messages/en.json

@@ -11,7 +11,6 @@
     "pantry": "Pantry",
     "shopping": "Shopping",
     "settings": "Settings",
-    "changelog": "Changelog",
     "admin": "Admin",
     "signOut": "Sign out",
     "apiKeys": "API keys",