release: v0.11.0 (#459)

Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.

## Headline changes since v0.10.0

- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)

Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).

## Verified

`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.

## After merge

Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

components/AssetProtection.tsx

@@ -13,7 +13,13 @@ export default function AssetProtection({ disableRightClick, disableImageDrag }:
 
     function handleContextMenu(e: MouseEvent) {
       const target = e.target as HTMLElement;
-      if (disableRightClick && (target.tagName === 'IMG' || target.closest('img') || target.classList.contains('photo-tile') || target.classList.contains('lightbox-img'))) {
+      if (
+        disableRightClick &&
+        (target.tagName === 'IMG' ||
+          target.closest('img') ||
+          target.classList.contains('photo-tile') ||
+          target.classList.contains('lightbox-img'))
+      ) {
         e.preventDefault();
       }
     }

components/Lightbox.tsx

@@ -328,9 +328,7 @@ export function Lightbox({
             </div>
           ) : exifData ? (
             <>
-              {exifData.description && (
-                <p className={styles.exifCaption}>{exifData.description}</p>
-              )}
+              {exifData.description && <p className={styles.exifCaption}>{exifData.description}</p>}
               {exifData.model && (
                 <div className={styles.exifRow}>
                   <span className={styles.exifLabel}>Camera</span>

components/ProofingContext.tsx

@@ -36,7 +36,9 @@ export function ProofingProvider({
 
   const storageKey = `folio_fav_${albumName.toLowerCase().replace(/[^a-z0-9]+/g, '-')}`;
 
-  // Hydrate from localStorage and URL query params on mount
+  // Hydrate from localStorage and URL query params on mount. This has to stay in
+  // an effect: both sources are browser-only, so reading them during render would
+  // break SSR and produce a hydration mismatch.
   useEffect(() => {
     try {
       const saved = localStorage.getItem(storageKey);
@@ -60,6 +62,9 @@ export function ProofingProvider({
         });
       }
 
+      // Mount-time hydration from an external store, not a render cascade:
+      // the state lands in the same commit and never re-triggers this effect.
+      // eslint-disable-next-line react-hooks/set-state-in-effect
       setFavorites(initialSet);
     } catch (e) {
       console.error('Failed to load favorites', e);

components/ProofingModal.tsx

@@ -12,7 +12,6 @@ export function ProofingModal() {
 
   const {
     favorites,
-    isModalOpen,
     setIsModalOpen,
     getProofingUrl,
     getFormattedList,