CHANGELOG: note the OIDC confirmation page reload fix

Author: kradalby

CHANGELOG.md

@@ -44,6 +44,7 @@ keys remain all-access.
 
 - Expiring or deleting a non-existent pre-auth key now returns an error instead of silently succeeding [#3324](https://github.com/juanfont/headscale/pull/3324)
 - Improve systemd service file hardening [#3341](https://github.com/juanfont/headscale/pull/3341)
+- Fix interactive OIDC login failing whenever the confirmation page was reloaded, by an ad blocker, the back button or pull-to-refresh; the page is now served from its own URL instead of the one carrying the single-use authorization code, and reaching it with `GET` no longer returns 405 [#3365](https://github.com/juanfont/headscale/issues/3365)
 - Headscale now requires Go 1.27 to build
 
 ## 0.29.3 (2026-07-29)