Release 2.3.0.0202: version-tagged images, changelog

- Drone: an image-tags step writes .tags (latest, commit SHA, changelog
  version) for the master publish, so each release can be pulled and
  rolled back by version. The master publish step no longer hardcodes tags.
- Version 2.2.0.0201 -> 2.3.0.0202 in xteve.go and changelog-beta.md, with
  a changelog entry covering the improvements branch.
- README / README-DEV describe the version tag.

changelog-beta.md

@@ -1,3 +1,20 @@
+#### 2.3.0.0202-beta
+```diff
++ Security: provider-supplied text is rendered as text in the web UI; websocket requests must come from the same origin; the session cookie is HttpOnly and SameSite=Strict; logo uploads, backup restores, the ffmpeg/VLC path and stream URLs are validated; backups can only be downloaded with a web session.
++ Passwords are stored with bcrypt. Existing accounts are upgraded on their next login.
++ Streaming: buffer state rewritten around a single lock with an atomic tuner limit; ffmpeg/VLC are stopped when the last client leaves or when no data arrives within 20 seconds; long streams no longer accumulate open handles.
++ Per-playlist buffer choice (default, none, xTeVe, FFmpeg, VLC) in the playlist dialog.
++ New filter type: regular expression.
++ Web UI: one persistent websocket with automatic reconnect, light theme following the OS setting, focus is kept when the menu refreshes, errors are announced to screen readers.
++ The web interface is embedded with go:embed and built from a pinned TypeScript toolchain; the language file is gone (English only).
++ New /healthz endpoint, used by the container healthcheck.
++ Container: PUID/PGID are applied at start-up; ffmpeg 9.0.2; images are also tagged with the release version.
++ Settings and other state files are written atomically; settings.json is readable by the owner only.
++ HTTP server and provider downloads have timeouts.
+- Removed the built-in self-updater. Updates are delivered through the container image.
+- Removed XTEVE_UID/XTEVE_GID as the documented variables (still accepted as a fallback for PUID/PGID).
+```
+
 #### 2.2.0.0201-beta
 Add UI enhancement for range selecting checkboxes