Changelog: record unreleased work (image delete, file references, member cap, API-key scopes)

[SiteRelEnby]

Backfills the [Unreleased] section, which only had the custom-field dedup entry. The image-delete/references, member-cap, and API-key-scope PRs all merged without changelog notes, so this records them ahead of the next version bump.

Adds under [Unreleased]:

• Added - file references view; dedicated messages:* API-key scopes.
• Changed - imports enforce the member cap (warn + hard-fail); new GET /v1/members/limit.
• Security - API keys can no longer manage API keys; dead scope list removed; scope-coverage test.
• Fixed - image delete prompts for step-up auth; poll creation over an API key (missing UI scope).

Docs only, no code.