docs: changelog for daemon-start auth handling, token self-heal, panel freshness

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

CHANGELOG.md

@@ -21,6 +21,21 @@ version + `kStudioVersion` in `lib/main.dart` stay in lockstep.
 
 ### Fixed
 
+- **Daemon start with a wrong token no longer misreports.** Both
+  start paths (welcome CTA, sidebar) treated an auth-rejected hub
+  as "daemon dead" and showed a start-failure dialog while the
+  banner above correctly blamed the token; an auth rejection now
+  counts as "daemon alive".
+- **Token fixed outside Studio heals the connection.** On an
+  auth-rejected poll the shell re-reads `~/.chain/hub-auth-token`
+  and reconnects when the file changed — following the banner's
+  own advice no longer requires re-saving in Settings or a
+  restart. An endpoint switch also resets the failure streak, so
+  a stale in-flight probe can't blame the new endpoint.
+- **Security panel stays fresh.** The auth-policy view re-queries
+  after saving or clearing the hub token in the panel above, and
+  renders the hub's new `reload_required` flag as a plain-language
+  pending-reload warning (DE+EN).
 - **Auth-rejected hub no longer reported as "unreachable".** With
   token auth active, a wrong or rotated token got UNAUTHENTICATED
   from a perfectly reachable hub, but the sustained-failure banner