docs: draft console release notes

[suculent]

Summary

• Add missing Phase 21 console release notes to the [Unreleased] section.
• Cover classic and Vue CSRF request wiring plus CSP host allowlist pinning.
• Preserve pre-existing untracked .flake-reports/ and nightshift.yaml in the submodule.

Verification

• git -C services/console diff --check -- CHANGELOG.md
• Manual markdown diff review

Assumptions

• These notes belong in [Unreleased] because the Phase 21 console changes are not otherwise documented in CHANGELOG.md.

---

Automated by nightshift

[suculent]

CI note: CircleCI Test Vue console fails during the setup/build step before project tests run: yarn: command not found in thinxcloud/console-build-env:vue. This PR only changes CHANGELOG.md; local verification passed with git -C services/console diff --check -- CHANGELOG.md and manual markdown diff review.