v0.1.1 — Maintenance release

Changed

• composer fund now lists the Ko-fi page — funding metadata ships in a tagged version
• Cookie subscriber drains the toast stack once (refactor, no behavior change)

Added

• Security & hardening design notes: the full threat model behind every protection
• Twig templates are now linted with twig-cs-fixer (composer lint:twig scripts + CI step)

Full changelog: v0.1.0...v0.1.1