v1.1.1

Maintenance release: updates the development dependencies flagged by Dependabot (vitest 5, vite 8, esbuild; none are shipped in the package) and moves npm publishing to trusted publishing (OIDC with provenance), so no long-lived npm token is needed. No behaviour change.