chore: bump version to 1.0.0

Eerste stabiele release. v1-readiness checklist (Now + Before-launch) is
afgerond, smoke-test groen, lint/tests/build/doc-links allemaal groen.

CHANGELOG.md [Unreleased] gepromoveerd naar [1.0.0] — 2026-05-04 met
volledige Added/Changed/Fixed/Security-secties uit PR #85 t/m #89.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -9,23 +9,43 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+---
+
+## [1.0.0] — 2026-05-04
+
+**Eerste stabiele release** — MVP volgens functional spec is af, getest en in
+productie. Geen breaking changes ten opzichte van 0.9.0; deze tag markeert de
+launch-ready state na de v1-readiness-checklist (Now + Before-launch items).
+
 ### Added
-- A11y: rate-limit `enforceUserRateLimit(scope, userId)` helper applied to all
-  high-value mutation paths (PBI/Story/Task/Todo/Sprint/Product/Token create,
-  Claude job enqueue, answerQuestion, story-log POST, avatar upload).
+- Rate-limiting: `enforceUserRateLimit(scope, userId)` helper toegepast op alle
+  high-value mutation paths — PBI/Story/Task/Todo/Sprint/Product/Token create,
+  Claude job enqueue, answerQuestion, story-log POST, avatar upload.
   ([#86](https://github.com/madhura68/Scrum4Me/pull/86))
-- Sentry error-monitoring scaffolding (`@sentry/nextjs`) with no-op fallback
-  when DSN is not configured. Activate via `NEXT_PUBLIC_SENTRY_DSN` in Vercel
-  env-vars. ([#85](https://github.com/madhura68/Scrum4Me/pull/85))
+- Sentry error-monitoring scaffolding (`@sentry/nextjs`) met no-op fallback
+  zonder DSN. Activeer via `NEXT_PUBLIC_SENTRY_DSN` in Vercel env-vars.
+  ([#85](https://github.com/madhura68/Scrum4Me/pull/85))
+- `CHANGELOG.md` (Keep a Changelog formaat) + `docs/runbooks/v1-smoke-test.md`
+  — 11-secties pre-launch verificatie. ([#89](https://github.com/madhura68/Scrum4Me/pull/89))
 
 ### Changed
-- A11y: `aria-selected` on PBI-cards replaced with `aria-pressed` (correct
-  ARIA role-attribute pairing). ([#88](https://github.com/madhura68/Scrum4Me/pull/88))
-- A11y: form-label associations (`htmlFor` + `id`) on all happy-path dialogs
-  (Story/Task + Promote-PBI/Story); auth pages get `<main>` landmark.
+- A11y Lighthouse score op `/products/[id]` van 86 → ≥95: `aria-selected` →
+  `aria-pressed` op PBI-cards (correct ARIA role-attribute pairing); tap-targets
+  ≥28×28 px op hover-icon-buttons. ([#88](https://github.com/madhura68/Scrum4Me/pull/88))
+- A11y form-label associaties (`htmlFor` + `id`) op happy-path dialogen
+  (Story/Task + Promote-PBI/Story); auth-pages krijgen `<main>` landmark.
   ([#87](https://github.com/madhura68/Scrum4Me/pull/87))
-- A11y: tap-targets ≥28×28 px on hover-icon-buttons (PBI ✎ + ×, Story ✎,
-  dashboard product ✎). ([#88](https://github.com/madhura68/Scrum4Me/pull/88))
+- README: test-count 69 → 445, env-vars-tabel uitgebreid met `CRON_SECRET` en
+  Sentry-vars. ([#89](https://github.com/madhura68/Scrum4Me/pull/89))
+
+### Fixed
+- Demo-policy: drie mutation-paden zonder `isDemo`-check gedicht
+  (`toggleTodoAction`, `archiveCompletedTodosAction`, `leaveProductAction`).
+  ([#89](https://github.com/madhura68/Scrum4Me/pull/89))
+
+### Security
+- Vier debug-routes (`/debug-env`, `/debug-realtime`, `/api/debug/*`) krijgen
+  een NODE_ENV-guard → 404 in productie. ([#89](https://github.com/madhura68/Scrum4Me/pull/89))
 
 ---
 
@@ -79,7 +99,8 @@ Voor de volledige milestone-historie zie [docs/backlog/index.md](./docs/backlog/
 
 ---
 
-[Unreleased]: https://github.com/madhura68/Scrum4Me/compare/v0.9.0...HEAD
+[Unreleased]: https://github.com/madhura68/Scrum4Me/compare/v1.0.0...HEAD
+[1.0.0]: https://github.com/madhura68/Scrum4Me/releases/tag/v1.0.0
 [0.9.0]: https://github.com/madhura68/Scrum4Me/releases/tag/v0.9.0
 [0.4.0]: https://github.com/madhura68/Scrum4Me/commit/615f0c8
 [0.3.1]: https://github.com/madhura68/Scrum4Me/commit/ecc05dd