docs: add Kasm Workspaces service and fix changelog

Document Kasm DinD architecture, Traefik integration, and the
proxy_port/frameDeny fixes that resolved session connection failures.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/03-SERVICES-OTHER.md

@@ -243,6 +243,29 @@ Non-critical services that enhance functionality but don't affect core network o
 
 ## Remote Access
 
+### Kasm Workspaces (Browser Isolation)
+
+| Component | IP | URL |
+|-----------|-----|-----|
+| kasm (DinD host) | 172.18.0.66 | https://kasm.xtrm-lab.org |
+| kasm_proxy | 172.19.0.8 (internal) | - |
+| kasm_api | 172.19.0.7 (internal) | - |
+| kasm_manager | 172.19.0.6 (internal) | - |
+| kasm_agent | 172.19.0.2 (internal) | - |
+| kasm_db | 172.19.0.3 (internal) | - |
+| kasm_guac | 172.19.0.9 (internal) | - |
+
+**Version:** 1.18.1
+**Architecture:** Docker-in-Docker (runs its own Docker daemon with internal containers)
+**Network:** dockerproxy (outer), kasm_default_network 172.19.0.0/16 (inner)
+**Ports:** 3000 (web UI), 6333 (proxy/sessions)
+**Data:** `/mnt/user/appdata/kasm/`
+
+**Traefik Integration:**
+- Uses `kasm-headers` middleware (no `frameDeny` — Kasm requires iframes)
+- Service backend: `https://172.18.0.66:6333` with `insecure-skip-verify`
+- Zone config: `proxy_port=443`, `proxy_hostname=$request_host$` (routes sessions through Traefik)
+
 ### RustDesk
 
 | Component | Ports |