v1.11.1

What's Changed

• Fixed the avatar upload page (/avatar/ui) failing PKCE over plain http: the PKCE challenge now uses a pure-JS SHA-256 instead of crypto.subtle (undefined in non-secure contexts), so a self-hosted http deployment can sign in and upload a profile picture (#94).