feat(update): let an up-to-date system read its own release notes (v1.38.4)

[iscarelli]

Why

The release-notes block on /admin/update lived entirely inside the update_available branch. Someone already on the latest version saw only "Sistema atualizado" — no notes, and not even the GitHub link that the update-available state offers. That is exactly what made it impossible to inspect the cumulative history right after production reached the latest version.

What changed

• New current_release_notes() in app.py: fetches the raw CHANGELOG.md at the installed version's own tag and reuses _slice_changelog to keep just that version's section. No duplicated parser, no duplicated renderer. Cached per installed version; fail-open ("" on any error), like its neighbours.
• Helper _version_just_below() derives the strict lower bound the slicer needs to isolate a single section (borrow-safe, never negative).
• admin_update() now computes the cumulative notes only when an update is actually available, and the installed version's notes only when it is not — so neither state pays for a fetch it does not use.
• The up-to-date branch of the template gained a "Ver novidades desta versão" collapse (new #currentNotes id, styled like the existing block), degrading to a plain link to the releases page when the notes cannot be fetched.
• New string translated in _EN and _ES; the block header reuses the already-translated Novidades da v{v} key.

Verify

.\run-tests.ps1 → 183 passed. New coverage: the function isolates only the installed version's section; fail-open returns "" without raising; /admin/update renders those notes in the up-to-date state; and falls back to the GitHub link (200, no traceback) when the fetch fails.

🤖 Generated with Claude Code