Release v0.5.1

[SylonZero]

Summary

Version bump for v0.5.1, tagging the deletion/cascade-safety/audit-trail initiative (PRs #60-#68, all already merged). Per the established release ritual: this is the version-bump commit, tagged before merge (v0.5.1 already pushed pointing at this branch's tip) — merging via a real merge commit (not squash/rebase) keeps the tag reachable from master.

Please merge with "Create a merge commit," not squash or rebase, so the v0.5.1 tag stays valid.

What's in this release

• Centralized audit logging for every mutation, UI and MCP alike
• Standardized attribution (createdBy/updatedBy) across tasks, products, organizations, and join tables
• New MCP delete tools: delete_task, delete_work_item, delete_code_plan, delete_release, each disclosing blast radius
• Wired the previously dead-code CodePlan/Release delete UI, plus confirmation dialogs on join/edge removals that had none
• Data migration backfilling creator attribution for existing rows
• Fixed a privilege-escalation vulnerability in role-change actions
• New shared delete-authorization library (lib/db/authz.ts) enforced identically across UI and MCP

Test plan

• pnpm exec tsc --noEmit — no new errors
• pnpm test — 270/270 passing
• pnpm build — succeeds
• Version-only + one README changelog line — no code changes in this PR

🤖 Generated with Claude Code

https://claude.ai/code/session_016ZM1Fxzj2sqge7EyGQ8LXb