fix(clublog): use OpsLog's own application API key

The embedded key was registered to XV9Q, not to OpsLog. Not a cosmetic
detail: Club Log identifies the client software by that key, so every
OpsLog upload in the world was attributed to that callsign. Its owner
received the abuse warning OpsLog earned when the on-close sweep was still
posting hundreds of QSOs through the realtime endpoint - and a revocation
aimed at them would have cut Club Log uploads for every user of this
program at once.

G7VJR issued a key for "OpsLog" on request. Same mechanism, same UX: the
key identifies the software, the operator still supplies their own e-mail
and password, so it authorises nothing on its own.

Club Log asks that it not be published in source code. The source is on a
private remote and only the built exe is released, but it remains
recoverable from that binary by anyone who looks - as it is for every
logger that embeds one. It is an identifier that can be attributed, not a
secret.

changelog.json

@@ -2,8 +2,12 @@
   {
     "version": "0.26.0",
     "date": "",
-    "en": [],
+    "en": [
-    "fr": []
+      "Club Log uploads are now identified as OpsLog. They were credited to another station's application key, which took the blame for them."
+    ],
+    "fr": [
+      "Les envois Club Log s’identifient désormais comme OpsLog. Ils étaient attribués à la clé applicative d’une autre station, qui en portait la responsabilité."
+    ]
   },
   {
     "version": "0.25.9",

internal/extsvc/clublog.go

@@ -40,12 +40,26 @@ func looksLikeHTML(s string) bool {
 // anything in the operator's log, which is what a test button must never do.
 const clublogDownloadURL = "https://clublog.org/getadif.php"
 
-// clublogAppAPIKey is OpsLog's Club Log *application* API key. Club Log
+// clublogAppAPIKey is OpsLog's own Club Log *application* API key, issued to
-// requires an api parameter that identifies the client software (not the
+// "OpsLog" by G7VJR on 2026-08-18.
-// user) — the same way Log4OM embeds its own key — so we ship it baked in
+//
-// rather than asking each user for one. It's an application identifier, not
+// Club Log requires an api parameter identifying the client SOFTWARE, not the
-// a user secret, but note it is visible in the source and the binary.
+// user — the same way Log4OM embeds its own — so it ships baked in rather than
-const clublogAppAPIKey = "5767f19333363a9ef432ee9cd4141fe76b8adf38"
+// asking every operator to request one.
+//
+// It replaces a key that was registered to XV9Q, not to OpsLog. That was not a
+// cosmetic detail: every OpsLog upload in the world was attributed to that
+// callsign, its owner received the abuse warnings OpsLog earned, and a
+// revocation aimed at them would have cut Club Log uploads for every user of
+// this program at once.
+//
+// Club Log asks that the key not be published in source code. The source lives
+// on a private remote and only the built exe is released — but the key is still
+// recoverable from that binary by anyone who looks, as it is for every logger
+// that embeds one. Treat it as an identifier that can be attributed, never as a
+// secret: it authorises nothing on its own, since every request also carries the
+// operator's own e-mail and password.
+const clublogAppAPIKey = "8df47807a412c586787c9401c96c10c135d6e580"
 
 // UploadClublog pushes one ADIF record to Club Log in real time. The user
 // supplies the account email + password and the logbook callsign; the