docs: reflect Reports Center + Attack Ops Center refinements, fix stale changelog note

Cross-repo documentation audit against argus-appliance's real current feature set
(v3.79.80): added a Reports Center bullet (guided JSON/CSV/HTML reporting, honestly scoped —
no PDF/scheduling/compliance templates yet) and expanded the Attack Origin Visualization bullet
with the two real additions from the appliance's Attack Operations Center follow-on (attack-type
coloring, fullscreen SOC wall mode).

Moved this changelog's own "not kept in sync" disclosure from a buried trailing note to the top
of the file, right under the title, so a reader sees it before the stale entries rather than
after — same honest content, just where it's actually useful.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to ARGUS are documented here, in plain language for operators.
 Versioning follows [Semantic Versioning](https://semver.org/).
 
+> **This file lags behind the currently shipped version** (the entries below stop at 3.29.0;
+> `./healthcheck.sh` or `GET /health` will show you what's actually running). Keeping it current
+> on every release needs to become part of the standard process — not backfilled retroactively
+> with invented descriptions of past changes. Updates always ship via `docker compose pull`
+> regardless of what this file says (see the [README](README.md#operations)).
+
 ## [3.29.0] — 2026-07-19
 
 ### Security
@@ -28,10 +34,3 @@ Versioning follows [Semantic Versioning](https://semver.org/).
 ## [3.26.0] and earlier
 
 Earlier release history predates this distribution's changelog.
-
----
-
-**Note (2026-07-25):** this file is not currently kept in sync with every release — the most
-recent entry above predates the current shipped version. Updating this changelog needs to
-become part of the standard release process going forward, not backfilled retroactively with
-invented descriptions of past changes.

README.md

@@ -52,8 +52,9 @@ integration off entirely from the same page.
 
 ### 🌐 Attack Origin Visualization
 A live global map of inbound attacks — real-time arcs from source to your infrastructure,
-color-coded by severity, with a running feed of top attacking countries and IPs. Pause, rewind,
+color-coded by severity or by attack type, with a running feed of top attacking countries and IPs
-and replay historical traffic, or click straight through to any single event's full detail.
+and a fullscreen "SOC wall" mode for a dedicated display. Pause, rewind, and replay historical
+traffic, or click straight through to any single event's full detail.
 
 ### 🔎 Incident Investigation
 Pivot from any IP, log line, or dashboard event straight into that entity's complete history —
@@ -114,6 +115,12 @@ confidence.
 Multiple backend servers with active health checks, plus TCP/UDP stream proxying with optional
 SNI routing for non-HTTP services.
 
+### 📄 Reports Center
+Generate a report over any time range — executive summary, WAF activity, bot protection, GeoIP
+distribution, backups, certificates, or overall infrastructure health — as JSON, CSV, or HTML,
+through a guided wizard. PDF export, scheduling, and compliance-framework templates are not
+available yet.
+
 ### 🔮 Modern Protocol Support
 HTTP/3 (QUIC) and post-quantum-ready TLS (ML-KEM hybrid key exchange) — ready for where the web
 is headed, not just where it's been.