v1.1.0

First feature + hardening release since the initial 1.0.0.

New

• Per-hashtag account filter and a global brand account setting.
• Account feed: [outpost_account_feed] shortcode and the Mastodon Account Feed block (original posts only).
• Redirect to the setup wizard on first activation.

Security

• Abuse controls (honeypot + per-IP rate limit) on the public subscribe endpoint.
• Subscription lookup now emails management links instead of exposing unsubscribe tokens, and no longer reveals whether an address is subscribed.
• Unsubscribe requires a POST confirmation, so link prefetch can't opt people out.
• Saving settings no longer re-runs activation or re-shows the setup wizard.

Accessibility

• Localized email lang, higher-contrast email and link colors, unique element IDs for repeated feeds/forms.

Performance & quality

• Paginated the subscribers admin screen; explicit option autoload.
• Hardened the schema migration to add columns deterministically (not via dbDelta diffing).
• PHPCS (WordPress-Extra) + PHPCompatibility, CI on a PHP 8.2 / 8.3 matrix. Minimum PHP is now 8.2.

All work was behaviorally verified in a real WordPress install (including live Mastodon API calls and full subscribe/unsubscribe HTTP flows).