mention CASTELLUM_PSEUDONYMS_API_ENABLED in API docs

See merge request !2026

block access to AttributeExportView on low privacy level

See merge request !2018

refine appointment reminder text

See merge request !2025

add APIPseudonymsView

See merge request !2017

add APIAttributesView

See merge request !2016

This reverts commit 5b9551d1.

fix: prevent users from choosing an arbitrary group for filters

See merge request !2022

check user.expiration_date in API

See merge request !2019

update dependencies

See merge request !2024

This is a security issue because users were able to select groups from
other studies, bypassing permission checks.

basic API docs

See merge request !2020

getting an incomplet attribute export is mostly useless

2FA: add recovery codes

See merge request !2011

link product home page from README

See merge request !2015

depends on https://github.com/xi/django-mfa3/tree/recovery-2

set study.announce_status_changes after message was sent

See merge request !2012

rename GDPR setting

See merge request !2010

to align with CASTELLUM_STUDY_STATUS_NOTIFICATION_TO

split settings for better overview

See merge request !2009

use mail body instead of recruitment text in study status notification (if available)

See merge request !2007

This is a simple way to sent only one PR mail per study.

The issue is that users may not expect that this field gets set
automatically. On the other hand it allows study coordinators to set
enable this again when they expect to make major changes.