Bump to v1.1.0 and bring all documentation current

Version bump in both pyproject.toml and package.json. Documentation
update covers everything shipped since v1.0.0 (direct messages,
message deletion, custom emoji, video attachments, DM/room email
notifications, active sessions, and more), and corrects claims that
had gone stale -- backend/README.md and DEPLOYMENT.md both still said
"no server-side session revocation" and backend/README.md said "no
custom/uploaded emoji," both now false.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

DEPLOYMENT.md

@@ -345,11 +345,12 @@ producing a gzipped `pg_dump` in `/var/backups/ds-chat/` with 14-day local
 rotation. Off-box shipping is a placeholder in that script (commented-out
 rsync/S3 examples) — decide where those need to go and fill it in.
 
-That script covers Postgres only. Uploaded chat images and file attachments
-both live on the **app** server's disk (`/srv/ds-chat/uploads`, created in
-§3a) — a separate machine from the data server this script runs on — and
-currently have no backup mechanism at all. Whatever off-box destination you
-pick above, include `/srv/ds-chat/uploads` in it too (e.g. a second `rsync`
+That script covers Postgres only. Uploaded chat images, file/video
+attachments, avatars, and custom emoji all live on the **app** server's
+disk (`/srv/ds-chat/uploads`, created in §3a) — a separate machine from
+the data server this script runs on — and currently have no backup
+mechanism at all. Whatever off-box destination you pick above, include
+`/srv/ds-chat/uploads` in it too (e.g. a second `rsync`
 line run from the app server).
 
 **Test a restore** (against a scratch database, never directly onto
@@ -389,13 +390,13 @@ Carried forward from earlier phases (see `backend/README.md`'s own "Notes /
 scope decisions" for the full detail on each):
 - No rate limiting on human or bot API traffic.
 - No CSRF token (relies on `SameSite=Lax` cookies).
-- No server-side session revocation (signed cookies only).
 - SSRF protection on outgoing webhooks is creation-time only, not
   re-validated per delivery (DNS-rebinding gap).
 - Backup off-box shipping is a placeholder — decide a destination and fill
   in `deploy/backup-postgres.sh`.
-- Uploaded chat images and file attachments (`/srv/ds-chat/uploads` on the
-  app server) have no backup coverage at all yet, on-box or off — see §7.
+- Uploaded chat images, file/video attachments, and custom emoji
+  (`/srv/ds-chat/uploads` on the app server) have no backup coverage at
+  all yet, on-box or off — see §7.
 - Uploaded-but-never-sent images or files (a user attaches one, then never
   hits Send) leak an orphaned file on disk — no cleanup job for this yet.
   Not a security issue (still gated by room membership to view), just an