docs(changelog): dedupe post-release 5.1.0 section and clean accumulated stray titles

[devondragon]

Post-release cleanup of CHANGELOG.md. The release plugin's generate_changelog.py prepends an AI-generated version section above the # Changelog title on every release, which has accumulated over time.

Removed (210 lines, deletions only — no content altered):

• The AI-generated duplicate ## [5.1.0] block sitting above the title, keeping the hand-curated [5.1.0] section (SemVer rationale + structured Security / Behavior changes / Migration subsections).
• Three stray # Changelog title lines left mid-file by past releases (in the [3.3.0], [3.2.1], [3.1.0] sections).
• A duplicate ## [4.2.0] section (two entries for the same release), keeping the concise one.

Result: a single # Changelog title and exactly one section per version, in descending order (5.1.0 → … → 3.0.0), no duplicates.

[Copilot]

Pull request overview

This PR performs post-release cleanup of CHANGELOG.md to remove release-plugin AI-prepended duplicate version blocks and stray repeated # Changelog titles, restoring a single top-level title and one section per release in descending order.

Changes:

• Removed the duplicated AI-generated ## [5.1.0] block that appeared above the main # Changelog title.
• Removed an extra duplicate ## [4.2.0] section so only one remains.
• Removed stray mid-file # Changelog headings within the 3.3.0, 3.2.1, and 3.1.0 sections.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[claude]

Review

Verified against the working tree (which already reflects this PR's merge state) — the changes do exactly what the PR description claims, cleanly:

• Only one # Changelog title remains in the file (line 1); the three stray mid-file # Changelog lines under [3.3.0], [3.2.1], [3.1.0] are gone.
• No duplicate version headers remain — ## [5.1.0] and ## [4.2.0] each now appear exactly once, and all versions are in strict descending order (5.1.0 → 3.0.0).
• Diffed the retained [4.2.0] section against the removed duplicate: the kept version covers the same ground (WebAuthn/passkey endpoints, TOCTOU fix, ON DELETE CASCADE, transports as List<String>) just more concisely, so no unique information was lost.
• This is a pure deletion diff (0 additions, 210 deletions) touching only CHANGELOG.md — no risk to build, tests, or runtime behavior.

Nothing to flag on code quality, bugs, security, or test coverage — this is a docs-only cleanup with no functional surface. Nice catch on identifying the root cause (the release plugin's generate_changelog.py prepending entries above the title) rather than just patching symptoms each release.

One minor, non-blocking suggestion: since this is a recurring artifact of the release automation, it might be worth a follow-up issue to fix generate_changelog.py itself so it doesn't keep reintroducing this drift on future releases — otherwise this cleanup will likely need repeating.