Update all documentation to current MySQL + React SPA + vm_api.py architecture

README, docs/{ARCHITECTURE,CONFIGURATION,INSTALL,OPERATIONS,SECURITY,TESTING}
and CHANGELOG were stale: they described the original SQLite + CardDAV +
zero-JS vm_web portal. Brought them in line with the actual code:
- MySQL (PyMySQL) as the default store; SQLite fallback only
- vm_contacts resolves from the MySQL contacts table (file/google/carddav removed)
- React SPA frontend + vm_api.py JSON API (:8098); vm_web.py now serves /audio/
- Apache vhost proxies /api/ -> :8098, /audio/ -> :8099, serves the SPA
- CSP relaxed to script-src 'self' 'unsafe-inline' (UI is now JavaScript)
- Added CHANGELOG 1.2.0 entry for the React/vm_api frontend work

CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 1.2.0 — 2026-08-13
+
+- **React SPA frontend + JSON API.** Added `vm_api.py` (FastAPI JSON API on
+  :8098) and a React frontend (`/home/jp/Work/voicemail-ui`, served as static
+  files with an SPA fallback by Apache). The portal UI is now a JavaScript SPA
+  (react-router-dom + TanStack Query + Vite), not the zero-JS server-rendered
+  app. `vm_web.py` (:8099) remains to serve `/audio/` playback and `/healthz`.
+- **Apache vhost updated** to proxy `/api/` → :8098, `/audio/` → :8099, serve
+  the React `dist`, and SPA-fallback to `index.html`. CSP relaxed to
+  `script-src 'self' 'unsafe-inline'` (was `script-src 'none'`) because the UI
+  is now JavaScript.
+- **Per-message / per-contact dropdown menus** in the UI (⋮): **Call back**
+  opens a `tel:` link from the sanitised caller digits; **Lookup number** opens
+  a who-called.co.uk reverse-lookup in a new tab, using the **0-prefixed** UK
+  number (swap `+44` → `0` before lookup, search by sanitised digits only).
+  Applied to both the Messages and Contacts pages.
+- **Contacts backfill on write.** Creating/updating a contact via the API now
+  updates matching `messages.contact_name`/`contact_email` (spaces/quotes
+  stripped before the LIKE; matches both E.164 and 0-prefix variants).
+- Documentation (`README.md`, `docs/*`) brought in line with the MySQL +
+  React + `vm_api.py` architecture.
+
 ## 1.1.0 — 2026-08-13
 
 - **Storage migrated to MySQL**: `vm_store` now defaults to MySQL (PyMySQL)
@@ -17,6 +39,9 @@
   cannot shadow real names.
 - **Migrations**: `vm_migrate_sqlite_to_mysql.py` and `vm_backfill_cdr.py`
   added under `src/` for first-run and CDR backfill.
+- **Contacts backend consolidated to MySQL only.** The `file` / `google` /
+  `carddav` resolver backends were removed; `vm_contacts` now resolves
+  exclusively from the MySQL `contacts` table.
 
 ## 1.0.0 — 2026-08-13
 
@@ -31,17 +56,12 @@ Initial build on mail.txt3.net (Debian 12, Asterisk 20, Apache 2.4, Postfix).
   any error (fail-safe).
 - **Telegram** (optional): per-mailbox routed voice-note DM with summary caption
   and transcript follow-up; degrades sendVoice → sendDocument → sendMessage.
-- **Contacts** (optional): caller-ID → name via `file` (vCard/CSV export),
-  `google` (People API OAuth), or `carddav` (app password; Nextcloud/Fastmail/
-  iCloud). Last-9-digit matching. Note: Google app passwords do not work.
 - **Web portal**: FastAPI app at `https://vm.txt3.net` — PIN login (mailbox +
   voicemail PIN from `voicemail.conf`), list, play, download, delete, per-user
-  settings. Zero JavaScript, `script-src 'none'` CSP, loopback-only backend
-  behind an Apache TLS reverse proxy. Brute-force lockout per (mailbox, IP).
-- **Storage**: SQLite store with content-addressed audio (decoupled from
-  Asterisk's renumbering) and DB-backed sessions.
+  settings. DB-backed sessions. Brute-force lockout per (mailbox, IP).
+- **Storage**: content-addressed audio (decoupled from Asterisk's renumbering).
 - **Backfill**: `vm_import.py` imports and transcribes existing spool recordings;
   idempotent on `(mailbox, origtime, callerid)`. Backfilled 157 historical
   messages on first run (3m40s, 0 failures).
-- **Packaging**: venv at `/opt/vm-transcribe`, systemd `vm-portal.service`,
-  Apache vhost + certbot TLS, `install.sh`.
+- **Packaging**: venv at `/opt/vm-transcribe`, systemd units, Apache vhost +
+  certbot TLS, `install.sh`.