v1.1.1

Changelog

• 8fd1313 fix: Add defense-in-depth path containment checks in storage layer
• cdb4126 fix: Add dummy DecryptWithKey in DecryptAndUpgrade success path to equalize timing
• 93993e5 fix: Check derivation error instead of nil key in Accept timing equalization
• 79fb832 fix: Log failures when re-wrapping vault key during legacy migration
• 2e29c68 fix: Make sanitizeError robust against unexpected error format patterns
• 4f9b526 fix: Use O_NOFOLLOW in DeleteVault to eliminate symlink TOCTOU window
• 3ffd58b fix: Use O_NOFOLLOW when opening audit log to prevent symlink attacks
• d9dc62e fix: Use ReadFileNoFollow in publicKeyHandler to prevent symlink TOCTOU
• 26042a8 fix: Use legacy key for dummy decrypt in VaultKey timing equalization
• 782671a fix: Use legacy key for dummy decrypt in decryptVaultSecret timing equalization
• 674bbd3 fix: Validate admin usernames at config load time to fail fast on invalid names