chore(release): 0.67.0 — E1 Foundation epic

Bump VERSION 0.66.0 -> 0.67.0 and add the user-facing release-notes entry for
the E1 Foundation epic (data-safety fixes, account-switch + search-error fixes,
graceful key-mismatch degrade; plus the security/test-net/CI/repro chores).

VERSION

@@ -1 +1 @@
-0.66.0
+0.67.0

frontend/src/lib/releaseNotes.ts

@@ -14,6 +14,23 @@ export interface ReleaseEntry {
 }
 
 export const RELEASE_NOTES: ReleaseEntry[] = [
+  {
+    version: "0.67.0",
+    date: "2026-08-18",
+    summary:
+      "A foundation release: reliability and security hardening under the hood, plus a few fixes you'll actually notice.",
+    fixes: [
+      "Canceling or pausing a download can no longer delete a video file that another download is still using — closing a rare race that could remove a file out from under a live download.",
+      "Switching to an account that was signed out elsewhere (after a password reset or “log out everywhere”) now just asks you to sign back in to that one account, instead of logging you out of every account in the switcher.",
+      "A failed YouTube search now shows the real reason instead of a generic “connection lost” message that silently retried and spent extra search quota.",
+      "If the server's encryption key is ever misconfigured, the app now starts and degrades gracefully instead of failing to load at all.",
+    ],
+    chores: [
+      "Security hardening around account linking and email verification: a password set on an address before it was verified is no longer trusted once the real owner proves ownership (via Google or admin approval), and linking a Google account now always attaches it to the account you're actually using.",
+      "A test safety net for the security-critical core — login and session revocation, feed paging, download finalization, and database-migration drift — that is required to actually run: the test lane now fails loudly instead of silently skipping when its database or tools are missing.",
+      "Reproducible, audited builds: dependencies are pinned to an exact lockfile that is scanned for known vulnerabilities on every build (which caught and cleared 4 cryptography-library CVEs), the runtime moved to Node 22, a server-side CI pipeline runs the full gate on every push, and baseline security response headers were added.",
+    ],
+  },
   {
     version: "0.66.0",
     date: "2026-08-17",