profile name sent with every table from now on

web/CHANGELOG.md

@@ -12,7 +12,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ---
 
-## [Unreleased]
+## [v0.8.46] — 2026-08-16
 
 ### Added
 
@@ -56,9 +56,19 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   so inherited `superadmin` authorization works and data roles are no longer
   treated as administrators. Login redirects structural users to the admin
   workspace and data users to analytics.
-- **Analytics and import/export use the caller's visible data** — profile-tree
-  discovery is authenticated, export is limited to readable tables, and
-  import is limited to tables for which the snapshot carries `insert`.
+- **Import and export are their own grant actions** — the import page requires
+  the caller's `import` grant and the export page the caller's `export` grant,
+  on top of the underlying row action each transfer performs (`insert` for
+  import, `read` for export). A table is offered only when the caller holds
+  both, so the menu never leads to a transfer the backend would refuse halfway
+  through. Profile-tree discovery for these pages is authenticated.
+- **CSV transfer system columns and header normalizing** — the import page
+  gained a "File includes system columns" checkbox (so `deleted` loads back as
+  it left) and a "Normalize headers" action that rewrites header rows into the
+  backend's column spellings before anything is posted; the export page gained
+  an "Include system columns" checkbox that adds `id`, `deleted`, and
+  `row_revision`. No new gRPC endpoint is consumed — these reuse
+  `PostTableDataBulk`, `GetTableDataByPosition`, and `GetTableDataCount`.
 - **Permission mutations keep the browser session** — grants, role changes and
   assignments now reload the live authorization state without replacing the
   identity-only JWT. The permissions workspace reloads in place and shows the