Release v0.5.3

[SylonZero]

Summary

Version bump for v0.5.3, tagging Product archive/soft-delete with hardened authorization (PR #74, already merged). Per the established release ritual: this is the version-bump commit, tagged before merge (v0.5.3 already pushed pointing at this branch's tip) — merging via a real merge commit (not squash/rebase) keeps the tag reachable from master.

This closes out the deletion & audit initiative started in v0.5.1: every core entity (Task, WorkItem, CodePlan, Release, Asset, Product) now has consistent, authorized, audited deletion — hard-delete where safe, reversible archive where the blast radius is too large to risk.

Please merge with "Create a merge commit," not squash or rebase, so the v0.5.3 tag stays valid.

What's in this release

• Product hard-delete replaced with the same archive/soft-delete tombstone proven by Assets in v0.5.2 — the highest blast radius in the schema. Nothing beneath a product (assets, plans, releases, work items, specs) is touched, it just stops resolving through the shared access check until restored.
• canDeleteProduct (previously defined but unused) now actually gates the delete path — org owner/admin or creator, matching the unified rule used everywhere else.
• New MCP tools archive_product/restore_product, disclosing blast-radius counts in the response
• UI: type-the-product-name-to-confirm archive dialog with real counts, a collapsible "Archived products" section with Restore, and an archived banner on the product detail page
• Closed an access-control gap: updateAssetAction had no check that the asset was actually accessible to the caller

Test plan

• pnpm exec tsc --noEmit — no new errors (two pre-existing, unrelated errors remain: passwordHash, CodePlan.productName)
• pnpm test — 297/297 passing
• pnpm build — succeeds
• Version-only + one README changelog line — no code changes in this PR

🤖 Generated with Claude Code

https://claude.ai/code/session_016ZM1Fxzj2sqge7EyGQ8LXb