v1.2.0: disable CSRF for Tor, fix wallet type validation, add version history modal

- fix(admin/csrf): completely disable CSRF checks for Tor/onion compatibility
- fix(validators): add 'main' and 'bonus' to WALLET_TYPES for purchase flow
- feat(admin): add clickable version tag with version history modal in sidebar
- docs: add VERSION.md with changelog and update instructions

VERSION.md

@@ -0,0 +1,34 @@
+# Telegram Shop — Version History
+
+## How to update version
+
+1. Edit this file (`VERSION.md`)
+2. Add new entry under `## Changelog`
+3. Bump version in `src/admin/views/partials/app-sidebar.ejs`
+4. Commit all changes together
+
+## Current Version
+
+**v1.2.0** — 2026-07-08
+
+## Changelog
+
+### v1.2.0 — 2026-07-08
+- **fix**: Disabled CSRF checks in admin panel for Tor / onion zone compatibility
+- **fix**: Fixed "Invalid wallet type" error in Telegram bot purchase flow (`main`/`bonus` types added to validator)
+- **feat**: Added version history modal in admin sidebar
+
+### v1.1.0 — 2026-07-02
+- **feat**: Mercuryo gateway integration, crypto QR deposit, mono products, wallet auto-refresh
+- **fix**: CSRF cookie `sameSite=false` for Tor, auth cookie fix, async handlers
+- **feat**: Draggable dashboard panels + business KPI redesign
+- **fix**: SmartAdmin template redesign + security hardening
+
+### v1.0.0 — 2026-06-24
+- **feat**: Initial release — Telegram shop bot with admin panel
+- **feat**: Crypto wallets (BTC, LTC, ETH, USDT, USDC)
+- **feat**: Product catalog with locations, categories, subcategories
+- **feat**: Purchase system with hidden content delivery
+- **feat**: Admin panel with dashboard, wallets, users, purchases, audit log
+- **feat**: Tor proxy support (.onion access)
+- **feat**: i18n localization (en/es/de)