Bump to 0.0.18 and add its release notes

Both files have to be on the commit that gets tagged: the release
workflow refuses to publish unless manifest.json equals the version
being released, and it prefers release_notes/0.0.18.md over notes
generated from commit history.

The notes lead with the drink-window counters, which are the reason a
user would want this release, then the two changes that need a decision
before updating: Home Assistant 2024.11 as the new minimum, and the
Status sensor now reporting a time.

No angle brackets anywhere in the notes. GitHub strips them when a
release body is published - the 0.0.16 notes say "<config>/www" in the
file and the published release reads "/www" - so entity IDs are written
against a concrete example account instead of a placeholder.

Also corrects the diagnostics test's module docstring, which still
described the denylist that the previous commit replaced with an
allowlist.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LLPEGFSy3fLEuXNUPAPWR4

Author: claude

custom_components/cellar_tracker/manifest.json

@@ -15,5 +15,5 @@
   "requirements": [
     "cellartracker==1.1.1"
   ],
-  "version": "0.0.17"
+  "version": "0.0.18"
 }

release_notes/0.0.18.md

@@ -0,0 +1,72 @@
+## Know what to drink tonight
+
+Two new sensors answer the question a cellar inventory is actually for:
+
+| Sensor | What it counts |
+|---|---|
+| **Ready to drink** | Bottles whose drinking window includes this year |
+| **Past drinking window** | Bottles whose window ended before this year |
+
+Both come from the drinking-window years CellarTracker already exports — `BeginConsume` and `EndConsume`, shown as **From** and **To** in the bottle table — so there is nothing to configure. Bottles with no drinking window are counted in neither — the export does not say, so neither do we.
+
+A wine in the last year of its window counts as **ready**, not past. The bottle table shows that year in red, which is a nudge to drink it rather than a claim that it has gone over.
+
+Substitute your own account name for `alice`:
+
+```yaml
+type: entities
+entities:
+  - entity: sensor.alice_ready_to_drink
+  - entity: sensor.alice_past_drinking_window
+```
+
+Useful in an automation, too — a monthly reminder of what needs drinking:
+
+```yaml
+trigger:
+  - platform: numeric_state
+    entity_id: sensor.alice_past_drinking_window
+    above: 0
+```
+
+## ⚠️ Requires Home Assistant 2024.11 or newer
+
+Up from 2024.7. Home Assistant 2024.11 added the `config_entry` argument that a data coordinator must now be given; without it, a future Home Assistant release refuses to set the integration up at all.
+
+If you are on 2024.7 to 2024.10, stay on 0.0.17 until you can update Home Assistant.
+
+## ⚠️ The `Status` sensor now reports a time
+
+It used to read `Connected`. It now reports **when the cellar last synchronised**, which is what actually tells you a six-hourly integration is still alive.
+
+Nothing breaks. It keeps its entity ID, so dashboards and automations pointing at it keep resolving — and its old value never changed once the integration was running, so nothing could have been triggering on it. Existing installs keep the `_status` entity ID; new ones get `_last_synchronised`.
+
+Its two attributes are gone. They held a fixed API path and a line of setup advice, which the recorder then stored with every state write. Both are in the README.
+
+## New: diagnostics
+
+**Settings → Devices & Services → CellarTracker → ⋮ → Download diagnostics** now produces a report you can attach to a bug.
+
+It carries the totals, the coordinator's state, the list of columns your export contains, and one sample bottle. It does **not** carry your password, your username, the entry title, or anything about where a bottle is stored — the sample is built from a fixed list of fields rather than by removing the sensitive ones, so a column CellarTracker adds in future is left out rather than published.
+
+The column list is the useful part when an export changes shape, which is the usual cause of a cellar that suddenly reads zero bottles.
+
+## Fixes
+
+* **A rate-limited cellar now backs off** instead of knocking again on schedule. CellarTracker's `Retry-After` is honoured, bounded to six hours, and never shortens the refresh interval you configured. Previously HTTP 429 was indistinguishable from an unreachable server.
+* **The dashboard no longer stalls Home Assistant while it loads.** The bottle list was converted to JSON inside the web request, which on a large cellar blocked everything else Home Assistant was doing for the duration. It is prepared in the background now.
+* **The bottle table loads faster**, especially on a phone: it asks for only the columns it displays, roughly a tenth of the data. The full `/api/cellartracker/inventory` response is unchanged, so any card you built against it keeps working.
+* **A malformed export is reported as one.** A wine with a very long tasting note could exceed a parser limit and surface as an unexplained error; it now says the export could not be read.
+* **Changing currency warns you** that Home Assistant records cellar value as a long-term statistic in its old unit, and that you may need to clear that sensor's statistics. Changing currency relabels the value — it does not convert it.
+* **An unrecognised currency no longer becomes US dollars silently.** It says so in the log and tells you how to correct it.
+* Credential handling was hardened: an error from CellarTracker now carries only its HTTP status, so a request URL — which contains your password, because that is how their export API accepts it — cannot reach a log file or a diagnostics report.
+
+## Entity names are translatable
+
+Every sensor name now comes from the translation files rather than being hardcoded English, so a Home Assistant running in another language can show them translated. English names are unchanged.
+
+## Under the hood
+
+329 tests, up from 190. Each fix was written test-first and confirmed to fail against the code it replaced.
+
+**Full Changelog**: https://github.com/GuvHas/cellartracker/compare/0.0.17...0.0.18

tests/test_diagnostics.py

@@ -6,9 +6,10 @@
 carry the request URL.
 
 What must never appear: the password, obviously, but also the username - it is
-half of a credential pair and identifies a real CellarTracker account. Nor the
-per-bottle Barcode, Location and Bin, which describe someone's home and are not
-ours to publish.
+half of a credential pair and identifies a real CellarTracker account - and the
+entry title, which *is* the username. Per bottle, anything outside a fixed
+allowlist: a denylist would have to be right about every column CellarTracker
+adds in future, and the export carries free-form notes that can say anything.
 
 What must appear: enough to diagnose the failures this integration actually
 has. The column list is the important one - it tells us whether CellarTracker