Remote Browser Feature

Signed-off-by: Ronni Skansing <rskansing@gmail.com>

docs/updates/1.36.0.md

@@ -0,0 +1,31 @@
+# 1.36.0 Update Notes
+
+## Remote Browser — systemd service update required
+
+To use the Remote Browser feature, existing installations must update the service file. Three hardening flags that block Chromium have been removed or relaxed:
+
+| Change | Reason |
+|--------|--------|
+| `AF_NETLINK` added to `RestrictAddressFamilies` | Chromium requires netlink sockets for udev device enumeration |
+| `RestrictNamespaces=true` removed | Chromium uses namespaces for its internal sandbox |
+| `MemoryDenyWriteExecute=true` removed | V8 JIT requires write+execute memory |
+
+1. Open the service file:
+   ```
+   systemctl edit --full phishingclub
+   ```
+
+2. Replace the relevant lines so they match:
+   ```
+   RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX AF_NETLINK
+   RestrictRealtime=true
+   RestrictSUIDSGID=true
+   ```
+   (`RestrictNamespaces` and `MemoryDenyWriteExecute` lines should be removed entirely)
+
+3. Reload and restart:
+   ```
+   systemctl daemon-reload && systemctl restart phishingclub
+   ```
+
+New installations via the built-in installer are not affected.