v0.1.1 — Tinker credentials end-to-end

First release after introducing the stable branch convention. Production deploys now track stable (this tag). Daily work continues on main.

Highlights since v0.1.0

Tinker API credentials (end-to-end)

• Encrypted storage at rest (AES-256-GCM via node:crypto with the auto-generated ENCRYPTION_KEY).
• Live validation against the Tinker worker: /tinker/validate calls ServiceClient().get_server_capabilities_async() with a 20s asyncio.wait_for ceiling so the SDK's silent retries can't hang the UI.
• Errors are classified and surfaced as clickable links (e.g. 402 → https://tinker-console.thinkingmachines.ai/billing/balance).
• Key is persisted even when validation fails, so the user can fix billing/network and click Revalidate without re-typing.

Framework / infra

• Renamed middleware.ts → proxy.ts (Next.js 16 convention); auth() still enforced at the page level as defense in depth.
• Initial Prisma migration committed at prisma/migrations/0_init/.
• Documented SSH update flow with --no-cache, --remove-orphans, and docker image prune -f.
• Added CLAUDE.md so future sessions land with the right deploy/ops constraints.

Branch model going forward

• main — active development, may break.
• stable — production-ready; advances when a release is cut.
• Pre-releases (vX.Y.Z-beta.N) cut from main for semi-ready cuts.

See README.md → Updating to a New Version for the new SSH deploy flow (git pull origin stable).