Harden RelayTV integration and prepare HACS 0.4.0 (#2)

* docs: add Home Assistant 0.4.0 hardening roadmap

* fix: protect media credentials and resume state

* feat: authenticate RelayTV API operations

* fix: make targeting and media state reliable

* test: add Home Assistant integration CI

* fix: validate API credentials during setup

* release: prepare HACS 0.4.0

* fix: align pytest dependency pin

* fix: close URL sanitizer gaps and correct player state reporting

Sync the sensitive-query-key list with the RelayTV server (adds auth,
exp, jwt, X-Emby-Token, X-Jellyfin-Token), filter query credentials
from relative URLs instead of returning them verbatim, and preserve
brackets around IPv6 literal hosts.

Also report volume on RelayTV's 0-100 scale unconditionally (a raw 1
is 1%, not full volume) and give the coordinator its own
position_updated_at stamp — the base DataUpdateCoordinator has no
last_update_success_time, so media_position_updated_at silently fell
back to now() on every read and the seek bar never extrapolated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -1,10 +1,35 @@
+# Changelog
+
+## 0.4.0
+
+- Remove credentials from media-player state and stored resume keys, migrate
+  legacy resume data, and cap the resume store at 500 entries.
+- Add optional RelayTV bearer-token configuration, setup validation,
+  reauthentication, and reconfiguration flows.
+- Report connection, authentication, and server errors instead of silently
+  treating failed actions as successful.
+- Prevent an invalid explicit service target from falling back to a different
+  RelayTV server and preserve the selected sidebar target during startup.
+- Add native mute support, accurate zero-valued media properties, stable
+  Home Assistant device metadata, and quieter idle-state event handling.
+- Add a pinned Home Assistant 2026.7 test environment and GitHub Actions CI.
+
+Security note: older Home Assistant recorder rows can retain media identifiers
+written by an earlier integration release. Rotate any affected upstream media
+API credentials and purge the RelayTV entity's old recorder history if those
+identifiers contained secrets.
+
+## 0.3.12
+
+- Fix the HACS release archive layout so `manifest.json` installs directly
+  under `/config/custom_components/relaytv/`.
+
 ## 0.2.3
+
 - Fix HA seek bar by providing media_position_updated_at.
 - Add entity_picture support (thumbnail) when RelayTV status includes artwork fields.
 - Improve seek/volume command payload compatibility.
 
-# Changelog
-
 ## 0.2.2
 - Fix `relaytv.smart_url` behavior: prefer enqueue/smart endpoints and avoid replacing current playback when possible.
 ## v0.2.1