chore: bump version to v0.2.9

[dholbach]

Summary

• Bumps version strings to v0.2.9 in version.py, prod.py, and docker-compose.prod.yml
• Adds CHANGELOG entry for v0.2.9
• Updates FEATURES.md with new security, capacity, and inquiry features
• Updates PROJECTS.md Recent Activity (capped at 2 entries)

What's in v0.2.9

Security: Global login enforcement (LoginRequiredMiddleware) + practice isolation fixes for session_toggle and email views (issues #164, #165); additional isolation tests.

Features: Configurable capacity periods in Practice Settings; client code suggester on inquiry/convert forms; pre-commit PII guard.

Bug fixes: revenue_report 500 error; per-client revenue now uses RevenueCalculator (M-PAT-02); 20 failing tests repaired.

Refactoring: Dashboard double-query reduction; ActionQueueBuilder decoupled; heatmap N→1 query.

i18n (P-039): Action-queue, dashboard widgets, forms.py, practice_views.py, inquiry_convert_confirm.html wrapped.

Governance: Responsible-disclosure policy (SECURITY.md).

Deps: uvicorn 0.50.0.

Test plan

• Version strings match in all three files
• CHANGELOG entry renders correctly
• After merge: tag v0.2.9, push tag, create GitHub release