Add Jira production UAT test script, update CHANGELOG

- Jira UAT test script for production API validation (all 10 use cases)
- CHANGELOG updates for recent features and fixes

CHANGELOG.md

@@ -1,59 +1,76 @@
 # Changelog
 
-## v1.0.0 — 2026-05-01
+All notable changes to the STEAM Security Dashboard are documented in this file.
 
-First official release. Consolidates all features developed since initial commit into a stable, documented, deployment-ready package.
+Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-### Core Platform
-- CVE tracking with multi-vendor support, document storage, and NVD API auto-fill
-- Session-based authentication with four user groups (Admin, Standard_User, Leadership, Read_Only)
-- Full audit logging of all state-changing actions
-- Dark tactical intelligence UI theme with monospace typography
+---
 
-### Ivanti Integration
-- Live sync of open host findings from Ivanti/RiskSense API (auto-sync every 24h)
-- Reporting page with donut metric charts, advanced per-column filtering, inline editing
-- FP workflow submission directly to Ivanti API with file attachments
-- Ivanti Queue — personal staging list for batch FP, Archer, CARD, and Granite workflows
-- Queue item redirect between workflow types after completion
-- Row visibility controls with localStorage persistence
+## [2.0.0] — 2026-05-19
 
-### Archive and Anomaly Tracking
-- Automatic detection of disappeared and returned findings across syncs
-- BU drift checker — classifies archived findings by reason (BU reassignment, severity drift, closed on platform, decommissioned)
-- Return classification — explains why findings came back (BU reassigned back, severity re-escalated, etc.)
-- Findings Trend chart with archive activity sparkline and shift reason tooltips
-- Anomaly banner for significant archive events
+### Breaking Changes
 
-### Compliance (AEO Posture)
-- Weekly NTS_AEO xlsx upload with diff preview (new, resolved, recurring)
-- Schema drift detection with breaking/silent-miss/cosmetic classification
-- Admin config reconciliation for parser updates
-- Per-team metric health cards with grouped categories and variant pills
-- Device-level violation tracking with timestamped notes history
-- Multi-metric note grouping
-- Upload rollback support
+- **PostgreSQL migration** — database engine switched from SQLite to PostgreSQL. Requires running `deploy-postgres.sh`, data migration, and `DATABASE_URL` env var. SQLite is no longer supported.
+- **Multi-BU tenancy** — data is now scoped per business unit with per-user team assignments. Replaces the previous binary scope toggle.
 
-### Integrations
-- Jira Data Center — create, sync, and track tickets linked to CVE/vendor pairs
-- Archer — risk acceptance exception tracking (EXC numbers)
-- Atlas InfoSec — action plan cache, bulk creation from row selection, metrics reporting
-- CARD API — Granite/CARD asset lookup for network device workflows
-- NVD API — auto-fill CVE metadata with bulk sync support
+### Features
 
-### Knowledge Base
-- Internal document library with inline PDF and Markdown rendering
-- Category-based browsing and search
+- **In-app notification system** — replaces Webex bot integration with native notifications
+- **Screenshot uploads** in feedback modal, Webex bot DM on issue close
+- **CCP Metrics page** — multi-vertical VCL upload and cross-org compliance reporting
+- **VCL compliance reporting** — exec report page, device metadata fields, bulk upload
+- **Aggregated burndown forecast** on CCP Metrics overview page
+- **Sub-team drill-down** — metric sub-team intermediate view with per-team breakdowns
+- **Metric breakdown panel** — Non-Compliant stat clickable, reveals metric breakdown buttons, compact grid with top 8 and show-all toggle
+- **Remediation plan and resolution date history tracking**
+- **Data management panel** — delete vertical, rollback upload, and reset all
+- **VCL vertical metadata** — inline-editable team fields on compliance routes
+- **Re-queue findings** from rejected FP submissions
+- **FP submissions cleanup** — auto-clear approved, dismiss rejected, collapsible section
+- **DECOM workflow type** — auto-note/hide on decom, show CVEs on CARD queue items
+- **Interactive configuration wizard** for deployment setup
+- **Unified setup script** (`configure.js`) merging deploy + config wizard
+- **Per-BU trend lines** in Ivanti counts history chart
+- **Multi-select BU picker** replacing binary scope toggle
+- **Configurable IVANTI_MANAGED_BUS** env var for multi-tenant drift classification
+- **Pipeline-to-issue traceability** via `after_script` comments in CI/CD
+- **CI/CD pipeline** with feedback modal, Atlas `qualys_id` fallback, and health endpoint
+- **Docker Compose** and `deploy-postgres.sh` for production cutover
+- **Systemd service scripts** for start/stop management
 
-### Admin
-- Full-page admin panel with user management, audit log, and system info tabs
-- Themed confirm modals replacing browser dialogs
-- User profile panel with self-service password change
+### Bug Fixes
+
+- Fix duplicate failing metrics on same asset across compliance endpoints
+- Fix duplicate chart entries on compliance page when multiple verticals share a report_date
+- Fix requeue inserting Postgres array literal instead of JSON into `cves_json`
+- Fix todo queue crash on malformed `cves_json` data
+- Fix AEO compliance page not showing metric health cards on dev
+- Fix double-counting in VCL multi-vertical stats — use only `ALL:` rollup rows
+- Fix compliance stats to use Summary sheet data instead of item counts
+- Fix route mount order: `vcl-multi` must precede general compliance router
+- Fix requeue: fallback to `finding_ids_json` when queue items are deleted or absent
+- Sync FP submission `lifecycle_status` from Ivanti `currentState` on fetch
+- Fix History tab crash: coerce Ivanti note fields to strings before rendering
+- Fix archive bar chart: `fmtDate` now handles ISO datetime strings from PostgreSQL date columns
+- Fix Ivanti panel bugs: Invalid Date, wrong workflow count, crash on archive click, BU scope filtering
+- Fix BU drift checker: derive `EXPECTED_BUS` from `IVANTI_BU_FILTER` env var
+- Fix null `bu_teams` in postgres migration, add retry logic to deploy script
+- Fix missing `created_by` column in `archer_tickets` table
+- Fix FP workflow counts donut scoped by BU
+- Fix `dotenv` loading in `db.js` so `DATABASE_URL` is available on import
+- Fix property test CI failure: mock db module before importing route
+
+### Maintenance
+
+- Track `package-lock.json` files for deterministic CI installs
+- Remove unused icon imports and unused imports to satisfy ESLint thresholds
+- CI pipeline fixes: dependency installation, lint thresholds, test isolation
+- Auto-run migrations in pipeline
+- Documentation updates for PostgreSQL migration, systemd scripts, and reference manual
+
+---
+
+## [1.0.0] — 2026-05-01
+
+Initial release of the STEAM Security Dashboard.
 
-### Infrastructure
-- Consolidated `setup.js` with complete database schema (27 tables, all indexes and triggers)
-- systemd service files for persistent deployment
-- GitLab CI/CD pipeline (install, lint, test, build, deploy)
-- GPG-signed commits for code provenance
-- Organized documentation structure (api, design, guides, security, testing, troubleshooting)
-- Migration scripts documented and retained for existing deployment upgrades