docs(changelog): add Furtka Gateway to 26.21-alpha

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -11,6 +11,15 @@ This project uses calendar versioning: `YY.N-stage` (e.g. `26.0-alpha` = 2026, r
 
 ### Added
 
+- **Furtka Gateway: apps reachable from the internet** (behind NAT/CGNAT,
+  no port forwarding). Settings → *Furtka Gateway*: enter the gateway URL
+  and registration token, the box registers and keeps a WireGuard tunnel to
+  a [furtka-gateway](https://forgejo.sourcegate.online/robert/furtka-gateway)
+  server (Traefik + wg-easy + control plane). Apps → ⋯ → *Expose to
+  Internet* publishes an app under its own hostname with Let's Encrypt;
+  *Stop exposing* takes it down again. Only apps whose manifest declares
+  `internet.viable: true` can be exposed. Client in `furtka/gateway.py` +
+  `furtka/wireguard.py`, CLI `furtka gateway …`.
 - **New logo: Mark M** (a lowercase *f* cut out of an arched gate), winner of
   the furtka.org vote (29 of 42 votes). It is now in the website header,
   favicon and share card, the installer header and tab icon, the on-box UI