release: v0.11.0 (#459)

Ships `dev` as **v0.11.0**. `main` contains nothing that `dev` does not,
so this is a clean sync.

## Headline changes since v0.10.0

- **Journal & Journal Studio** — photo essays at `/journal`,
split-screen block editor with live preview, drafts, per-entry
passwords, cover images
- **First-run setup wizard at `/install`** — configure a fresh
deployment from the browser; credentials are verified against Immich
before anything is written, and the wizard is gated by a one-time token
- **About page editor and toggle** in the admin panel
- **Per-album photo order** independent of Immich, with a drag & drop
editor
- **Custom favicon upload**
- **Experimental portfolio features** — justified grid, `cover` hero,
unlisted subpages, per-album grid overrides, cover focal points,
external nav links
- **Security** — asset tokens length-capped before decoding (#423),
journal author markdown escaped rather than filtered, journal file paths
contained, admin session key derived with scrypt (#432), Next.js 16.3.0
for CVE-2025-13465
- **Fixed** — client proofing honours its own configuration again
(#454); journal photo rendering (#432)

Full detail in [CHANGELOG.md](CHANGELOG.md#0110--2026-08-15).

## Verified

`npx tsc --noEmit` clean · `npx vitest run` 435 tests pass · `npm run
build` succeeds · lint 0 errors · `prettier --check` clean · local
`docker build` of the release tree.

## After merge

Tag `v0.11.0` on `main` and publish the release — that triggers
`docker-publish.yml`, which pushes the image and moves `latest`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

lib/__tests__/proofing-resolution.test.ts

@@ -0,0 +1,50 @@
+import { describe, it, expect, vi } from 'vitest';
+
+// Mock env.ts so importing config.ts doesn't trigger validation
+vi.mock('@/lib/env', () => ({
+  env: {
+    IMMICH_API_URL: 'http://localhost:2283',
+    IMMICH_API_KEY: 'test-key',
+    SITE_TITLE: 'Test Gallery',
+    SITE_SUBTITLE: '',
+    CACHE_TTL: 300,
+    IMMICH_TIMEOUT_MS: 15000,
+    RATE_LIMIT_RPM: 120,
+    TRUSTED_PROXY_HOPS: 0,
+  },
+}));
+
+import { resolveProofing } from '@/lib/config';
+
+/**
+ * Client proofing hands a gallery to a client and takes their picks back, so
+ * whether it is on is a delivery decision, not a cosmetic one. The controls
+ * were previously mounted unconditionally and these settings were inert; these
+ * cover the precedence now that they are honoured.
+ */
+describe('resolveProofing', () => {
+  it('falls back to the global setting when the subpage says nothing', () => {
+    expect(resolveProofing(undefined, true)).toBe(true);
+    expect(resolveProofing(undefined, false)).toBe(false);
+    expect(resolveProofing({}, true)).toBe(true);
+    expect(resolveProofing({}, false)).toBe(false);
+  });
+
+  it('lets a subpage switch proofing on against a global off', () => {
+    // The client-handover case: proofing off across a public portfolio, on for
+    // the one subpage that is a delivery.
+    expect(resolveProofing({ proofing: true }, false)).toBe(true);
+  });
+
+  it('lets a subpage switch proofing off against a global on', () => {
+    // The regression guard: `||` instead of `??` would silently discard this,
+    // leaving hearts on a page that explicitly asked for none.
+    expect(resolveProofing({ proofing: false }, true)).toBe(false);
+  });
+
+  it('treats an explicit false as a decision, not as absence', () => {
+    // Same distinction stated directly — `proofing: false` must not read as
+    // "unset" and inherit the global default.
+    expect(resolveProofing({ proofing: false }, true)).not.toBe(resolveProofing(undefined, true));
+  });
+});