docs: draft release notes

[suculent]

Summary

• Add a new top HISTORY.md entry for 6/7/2026 1.13 — Web Hardening.
• Summarize changes since the 29/6/2026 1.12 entry: CSRF/SameSite hardening, console CSP/CSRF wiring, worker and Arduino builder operational fixes, and MQTT-heavy CI stability.
• Update the services/console submodule pointer to include the console changelog-only release-note commit from docs: draft console release notes thinx-cloud/console#27.

Files changed

• HISTORY.md
• services/console submodule pointer (d41d4ba8 -> 1dac7023)
• Console submodule PR: docs: draft console release notes thinx-cloud/console#27

Verification

• git diff --check -- HISTORY.md
• git -C services/console diff --check -- CHANGELOG.md
• Manual markdown diff review with git diff -- HISTORY.md and git -C services/console diff -- CHANGELOG.md

Assumptions

• The release-note scope starts after the documented 29/6/2026 1.12 root history entry.
• Submodule pointer changes are included only where they represent release-facing security or operational behavior.
• Pre-existing dirty state was preserved and not staged: services/broker, submodule untracked files, and root nightshift.yaml.

[suculent]

CI note: the linked console changelog PR (thinx-cloud/console#27) currently has a CircleCI setup failure: yarn: command not found in Test Vue console, before project tests run. Parent release-note verification passed locally with git diff --check -- HISTORY.md; parent checks were triggered by pushing nightshift/release-notes.