v1.1.0

Added

• Custom themes: put a JSON file with the 14 colors in the themes folder next to config.json. A theme
  that is not valid is skipped with a warning in the status bar.

Changed

• The mascot animation preloads its frames before showing them, which removes a flicker on the first click.

Fixed

• A notes folder that is given as a relative path or as a symbolic link is now resolved and walked through
  its real path, and stays confined. Inline tags follow the tag rules.

Security

• Theme names only accept a-z, 0-9, dot, hyphen and underscore, and the warnings shown for a bad theme
  escape control characters, so a crafted theme file cannot inject terminal escape sequences.
• GitHub Actions workflows were hardened: checkouts no longer persist credentials and the release job does
  not use the build cache.