fix: Resolve 500/404 cascade — JWT tenant context, wipe routes, changelog stub

Root cause: super_admin JWT returned early with no license_id, causing
@CurrentTenant() to pass undefined to every tenant-scoped service query.

- jwt.strategy: Move license lookup before super_admin early return so
  admins who own licenses get their license_id in the JWT payload
- CurrentTenant decorator: Throw 401 with clear message when license_id
  is undefined instead of letting undefined cascade into TypeORM queries
- Wipe store: Fix 6 wrong routes (/profiles → /wipes/profiles, etc.)
  and remove redundant manual license_id guards
- Changelog module: Add stub controller/service returning empty array
  to eliminate 404 on /api/changelog
- ChangelogView: Handle both array and {entries} response shapes
- AGENTS.md: Streamlined 3-tier roster (Opus/Sonnet/Haiku)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

frontend/src/views/admin/ChangelogView.vue

@@ -21,11 +21,12 @@ const hasMore = ref(true)
 async function fetchChangelog() {
   isLoading.value = true
   try {
-    const result = await api.get<ChangelogEntry[]>(`/changelog?page=${page.value}&limit=20`)
-    if (result.length === 0) {
+    const result = await api.get<{ entries: ChangelogEntry[] } | ChangelogEntry[]>(`/changelog?page=${page.value}&limit=20`)
+    const items = Array.isArray(result) ? result : (result.entries ?? [])
+    if (items.length === 0) {
       hasMore.value = false
     } else {
-      entries.value.push(...result)
+      entries.value.push(...items)
     }
   } finally {
     isLoading.value = false