[Django's docs on
timezones](https://docs.djangoproject.com/en/3.2/topics/i18n/timezones/)
explain that it "stores datetime information in UTC in the database,
uses time-zone-aware datetime objects internally, and translates them to
the end user’s time zone in templates and forms".

So places where we format datetimes manually (e.g. for emails) the
conversion to local time also needs to be done manually.

Most of these cases are internal, but the appointment reminder mails are
critical.

update changelog for 0.65.0

See merge request !2027

translations

See merge request !2028

allow exportable attributes of any privacy level

See merge request !2023

mention CASTELLUM_PSEUDONYMS_API_ENABLED in API docs

See merge request !2026

block access to AttributeExportView on low privacy level

See merge request !2018

refine appointment reminder text

See merge request !2025

add APIPseudonymsView

See merge request !2017

add APIAttributesView

See merge request !2016

This reverts commit 5b9551d1.

fix: prevent users from choosing an arbitrary group for filters

See merge request !2022

check user.expiration_date in API

See merge request !2019

update dependencies

See merge request !2024

This is a security issue because users were able to select groups from
other studies, bypassing permission checks.

basic API docs

See merge request !2020

getting an incomplet attribute export is mostly useless

2FA: add recovery codes

See merge request !2011

link product home page from README

See merge request !2015

depends on https://github.com/xi/django-mfa3/tree/recovery-2