docs: record work-order priority (Magazine, Character, Audiobook)

No code change. User set explicit priority for upcoming feature work:
Magazine reader roadmap first, then the character-identity system,
then audiobook speaker attribution. Recorded in TODO.md so it survives
a context reset. Deployment and the deferred multi-user initiative
stay explicitly parked, not part of this order.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,13 @@ Follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) · versioned wi
 
 ---
 
+## [1.28.1] — 2026-09-14
+
+### Added
+- Recorded the user's explicit priority order for upcoming feature work in TODO.md: Magazine reader roadmap, then Character system, then Audiobook speaker attribution. No code change.
+
+---
+
 ## [1.28.0] — 2026-09-14
 
 ### Added

TODO.md

@@ -24,6 +24,21 @@ namespace/manifest foundations and section-scoped lazy loading are working and
 regression-tested. Remaining P1 work is intentionally open where it needs a real
 architecture change: the larger Audiobook/Rehearser/style split.
 
+### Work order — set 2026-09-14
+
+User-set priority for picking up feature work, in this order:
+
+1. **Magazine reader roadmap** (below) — contents-view redesign is blocked on a
+   layout decision from the user; the other open items (image/chart descriptions,
+   legal source browsing) are actionable without one.
+2. **Character system** — portrait/concept-sheet identity mismatch, then
+   character-form UX polish.
+3. **Audiobook speaker attribution** — resume from Book 1 re-measurement, then
+   the never-yet-run Book 2 generalization regression.
+
+Deployment and the deferred multi-user initiative below are explicitly parked,
+not part of this order.
+
 ### P0 — do first
 
 - [x] **S — Stop provider API keys from reaching frontend JavaScript or logs.** Provider keys are masked in settings

VERSION

@@ -1 +1 @@
-1.28.0
+1.28.1