release: v0.11.0 (#459)

Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.

## Headline changes since v0.10.0

- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)

Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).

## Verified

`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.

## After merge

Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

app/api/admin/backups/route.ts

@@ -83,7 +83,11 @@ export async function POST(req: Request) {
     }
 
     // Security check: prevent directory traversal
-    if (backupFilename.includes('..') || backupFilename.includes('/') || backupFilename.includes('\\')) {
+    if (
+      backupFilename.includes('..') ||
+      backupFilename.includes('/') ||
+      backupFilename.includes('\\')
+    ) {
       return NextResponse.json({ error: 'Invalid backup filename' }, { status: 400 });
     }
 

app/api/admin/journal/[slug]/route.ts

@@ -1,10 +1,6 @@
 import { NextResponse } from 'next/server';
 import { isAdminAuthenticated, isAdminEnabled } from '@/lib/admin/auth';
-import {
-  isValidSlug,
-  sanitizeSlug,
-  parseJournalMarkdown,
-} from '@/lib/journal';
+import { isValidSlug, sanitizeSlug, parseJournalMarkdown } from '@/lib/journal';
 import {
   readJournalEntry,
   writeJournalEntry,
@@ -65,9 +61,7 @@ export async function PUT(request: Request, context: RouteContext) {
     parseJournalMarkdown(rawMarkdown);
 
     const targetSlug =
-      typeof body.newSlug === 'string' && body.newSlug
-        ? sanitizeSlug(body.newSlug)
-        : slug;
+      typeof body.newSlug === 'string' && body.newSlug ? sanitizeSlug(body.newSlug) : slug;
 
     if (!isValidSlug(targetSlug)) {
       return NextResponse.json({ error: 'Invalid target slug' }, { status: 400 });

app/api/admin/journal/route.ts

@@ -1,10 +1,6 @@
 import { NextResponse } from 'next/server';
 import { isAdminAuthenticated, isAdminEnabled } from '@/lib/admin/auth';
-import {
-  sanitizeSlug,
-  isValidSlug,
-  type JournalFrontmatter,
-} from '@/lib/journal';
+import { sanitizeSlug, isValidSlug, type JournalFrontmatter } from '@/lib/journal';
 import {
   listJournalEntries,
   writeJournalEntry,
@@ -47,7 +43,10 @@ export async function POST(request: Request) {
 
     const existing = await readJournalEntry(slug);
     if (existing) {
-      return NextResponse.json({ error: 'A journal entry with this slug already exists' }, { status: 409 });
+      return NextResponse.json(
+        { error: 'A journal entry with this slug already exists' },
+        { status: 409 },
+      );
     }
 
     const frontmatter: JournalFrontmatter = {
@@ -56,7 +55,9 @@ export async function POST(request: Request) {
       draft: true,
       ...(typeof body.subtitle === 'string' && body.subtitle ? { subtitle: body.subtitle } : {}),
       ...(typeof body.author === 'string' && body.author ? { author: body.author } : {}),
-      ...(typeof body.coverAssetId === 'string' && body.coverAssetId ? { coverAssetId: body.coverAssetId } : {}),
+      ...(typeof body.coverAssetId === 'string' && body.coverAssetId
+        ? { coverAssetId: body.coverAssetId }
+        : {}),
     };
 
     let initialMarkdown = body.content;

app/api/admin/settings/route.ts

@@ -40,7 +40,10 @@ export async function PUT(request: Request) {
     invalidateConfigCache();
     immich.invalidateAll();
     revalidatePath('/', 'layout');
-    return NextResponse.json({ success: true, message: 'Saved successfully. Backup of previous version created.' });
+    return NextResponse.json({
+      success: true,
+      message: 'Saved successfully. Backup of previous version created.',
+    });
   } catch (err) {
     console.error('[Admin] Failed to write settings.yaml:', err);
     return NextResponse.json({ error: 'Failed to save settings' }, { status: 500 });

app/api/analytics/track/route.ts

@@ -69,7 +69,7 @@ export async function POST(req: Request) {
 
     await saveAnalytics(data);
     return NextResponse.json({ ok: true });
-  } catch (err) {
+  } catch {
     return NextResponse.json({ error: 'Failed to record tracking' }, { status: 500 });
   }
 }

app/api/auth/route.ts

@@ -51,7 +51,8 @@ export async function POST(request: NextRequest) {
     }
 
     if (!isProtected(slug, type)) {
-      const typeLabel = type === 'journal' ? 'Journal entry' : type === 'subpage' ? 'Subpage' : 'Album';
+      const typeLabel =
+        type === 'journal' ? 'Journal entry' : type === 'subpage' ? 'Subpage' : 'Album';
       return NextResponse.json(
         {
           error: `${typeLabel} is not password-protected`,

app/api/install/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { revalidatePath } from 'next/cache';
 import { completeInstall, isInstalled, normalizeApiBase, validateSetupToken } from '@/lib/install';
 import { invalidateConfigCache } from '@/lib/config';
+import { DEFAULT_PRESET } from '@/lib/config/theme';
 import { immich } from '@/lib/immich';
 import { checkRateLimit, getClientIp, retryAfterSeconds } from '@/lib/rate-limit';
 
@@ -9,8 +10,8 @@ import { checkRateLimit, getClientIp, retryAfterSeconds } from '@/lib/rate-limit
 const INSTALL_RPM = 10;
 
 const THEME_PRESETS = [
-  'studio',
   'studio-modern',
+  'studio',
   'minimal',
   'editorial',
   'classic',
@@ -58,7 +59,7 @@ export async function POST(request: NextRequest) {
     return NextResponse.json({ error: 'Invalid Immich URL' }, { status: 400 });
   }
 
-  const theme = THEME_PRESETS.includes(body.theme) ? body.theme : 'studio';
+  const theme = THEME_PRESETS.includes(body.theme) ? body.theme : DEFAULT_PRESET;
 
   // Album selection is optional: an empty gallery is a valid install.
   const rawAlbums: unknown[] = Array.isArray(body.albums) ? (body.albums as unknown[]) : [];