1.1.0: changelog, README quick start without a clone, help and in-app changelog

The quick start downloads two files and pulls the image; no clone, no
build. README figures brought up to date (it still said Astro 5, 124
tests, 16 migrations). Upgrade notes for 1.0 installs: the volume
ownership change and the basic-ftp NAT behaviour. Help page and in-app
changelog in English and German.

CHANGELOG.md

@@ -1,5 +1,63 @@
 # Changelog
 
+## 1.1.0 — 2026-10-10
+
+**Install without cloning or building**
+
+- **Prebuilt image** for linux/amd64 and linux/arm64 at
+  `ghcr.io/tillheidrich/klarbild`. The compose files pull `:1`, which follows every
+  1.x release; an update is `docker compose pull && docker compose up -d`. The quick
+  start needs two downloaded files instead of a clone and a build.
+- The image is two-stage: no compiler, no dev dependencies, no source tree at runtime.
+  It **runs as uid 1000**, not root.
+
+**First visit**
+
+- On a print-only instance the print studio no longer offers "Pick from the library" —
+  the library belongs to the AI module, and on an instance without it the button
+  opened an empty picker. In its place: **Try it with a sample photo**, an original
+  illustration that goes through the normal upload.
+- A favicon and an iPhone home-screen icon.
+
+**Trash (AI module)**
+
+- Deleting moves an image into the **trash** instead of removing it on the spot. It is
+  hidden from the library, share links, ZIPs, deliveries, the mirror, print sources and
+  the print history, and comes back unchanged on restore. "Undo" in the toast, a trash
+  view with days left, restore, delete for good, empty.
+- Maintenance purges after `trash_days` (default 30, Admin → Storage & cleanup). 0
+  switches the trash off.
+- An image trashed while queued is skipped instead of being generated and billed.
+- Purging removes only files no other image still uses: alternatives share their source
+  with the original.
+- API: `DELETE /api/items/:id` now trashes (`?purge=1` for good), `GET|POST|DELETE
+  /api/trash`. See `/llms.txt`.
+
+**Fixed**
+
+- Only the file route checked who may see an image. Rename, delete, retry, alternative,
+  reuse and the selection ZIP accepted any id from any signed-in account. One rule now
+  (`src/lib/itemaccess.ts`): read your own, or a shared library but never a private
+  session; change only your own; admins everything. A refused id answers 404.
+- README said Astro 5; it is Astro 7.
+
+**Dependencies**
+
+- nodemailer 10, basic-ftp 6, argon2 0.45, archiver 8, ssh2-sftp-client 12,
+  @astrojs/react 7, Astro 7.3.8, sharp 0.35.5 — `npm audit` 0 (was 7, six high).
+- Node ≥ 22.12.
+- Not taken yet: pg-boss 12 (it cannot migrate the v10 queue schema in place) and
+  TypeScript 7.
+
+**Upgrading from 1.0**
+
+- If you built 1.0 yourself with the old compose file, your files volume belongs to
+  root. The new image runs as uid 1000, so hand the volume over once:
+  `docker compose run --rm --user root app chown -R 1000:1000 /data`
+- basic-ftp 6 no longer silently redirects the data connection when an FTP server
+  behind NAT announces its private address. If a delivery target that worked fails
+  now, "Test connection" names the cause.
+
 ## 1.0.0 — first public release
 
 The first open-source release of Klarbild. Everything before this lived in a