docs: sync release, frontend, and GeoIP guidance

[XiNian-dada]

Summary

• backfill CHANGELOG.md from v2.2.7 through v3.0.2-rc.2
• replace the obsolete Stage 0 frontend README with the current Vue architecture, routes, state flow, commands, tests, and embedded-build workflow
• document NODELITE_BUILD_VERSION as the official tag-derived version source and workspace 0.1.0 as the local fallback
• disclose the default online ipwhois GeoIP lookup, the public connection IP sent to https://ipwho.is, and offline/disabled alternatives

Verification

• git diff --check NodeLite/main...HEAD
• pnpm --dir nodelite-server/web lint
• pnpm --dir nodelite-server/web typecheck
• pnpm --dir nodelite-server/web test (81 files, 490 tests)
• cargo test -p nodelite-proto parses_server_config_with_defaults
• cargo test --workspace
• cargo clippy --all-targets -- -D warnings
• verified config/server.example.toml changes are comments only
• verified GeoIP defaults and implementation are unchanged

Closes #318
Closes #310

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b72cdce790

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Disclose dashboard-user IP lookups

With the default ipwhois provider, the disclosure is not limited to Agent addresses: successful Basic Auth requests call state.geoip.lookup(meta.client_ip) in nodelite-server/src/handlers/auth_routes/middleware.rs, and successful TOTP logins do the same in two_factor.rs, causing public dashboard-user IPs to be sent to ipwho.is as well. Operators relying on this privacy notice may therefore leave the feature enabled without realizing that viewer/admin addresses are disclosed; update this notice and the equivalent English README and example-config comments to describe both Agent and login-client lookups.

Useful? React with 👍 / 👎.