release: 1.1.0: Domain-admin role and internal/web package split

The first MINOR after 1.0.0: send-only DMARC guidance in the panel, AGPL packaging on every page, and an internal split of `internal/web` ahead of domain-admin work. Upgrading runs one SQLite migration (empty defaults; existing DNS guidance is unchanged until you set a report address).
Changed:
  - `internal/web` split into subpackages (`web/view`, `web/auth`, `web/validate`,
Added:
  - panel: DMARC guidance for send-only relays — the suggested `_dmarc` record
  - AGPL packaging hygiene: [NOTICE](NOTICE) names the copyright holder and the
  - [docs/roadmap.md](docs/roadmap.md) — candidate item **visual-style** (panel

Full detail: CHANGELOG.md (1.1.0).

docs/development.md

@@ -92,8 +92,9 @@ mechanics → Haiku. Reviewers must not be the author of the code under review.
 
 ## External libraries
 
-The project is **AGPL-3.0** ([LICENSE](../LICENSE)). New Go dependencies must
-be permissive or GPL-family (see
+The project is **AGPL-3.0** ([LICENSE](../LICENSE)). Copyright holder and
+third-party notices: [NOTICE](../NOTICE). New Go dependencies must be
+permissive or GPL-family (see
 [.cursor/rules/agent-rules.mdc](../.cursor/rules/agent-rules.mdc)).
 
 ### Main module (`go.mod`)
@@ -107,6 +108,12 @@ be permissive or GPL-family (see
 Transitive dependencies — `go mod graph` / `go.sum`; all indirect packages in
 the tree are AGPL-3.0-compatible.
 
+### Vendored front-end
+
+| Asset | Version | Repository | License |
+|---|---|---|---|
+| `internal/web/view/static/htmx.min.js` | 2.0.4 | <https://github.com/bigskysoftware/htmx> | 0BSD |
+
 ### E2e module (`test/e2e/go.mod`)
 
 | Package | Version | Repository | License |
@@ -121,6 +128,8 @@ the image.
 Postfix, OpenDKIM, `supervisord`, `sasl2-bin`, `logrotate`, and others come
 from Debian bookworm repositories; licenses are in each package's `copyright`
 file on <https://packages.debian.org/bookworm/>.
+The image also ships [LICENSE](../LICENSE) and [NOTICE](../NOTICE) under
+`/usr/share/doc/selfpost/`. The panel serves the AGPL text at `/license`.
 
 ---
 
@@ -132,7 +141,7 @@ Requires Go 1.26+ and `CGO_ENABLED=0`.
 
 ```sh
 make build        # bin/panel, bin/selfpost-backup (VERSION=dev by default)
-make build VERSION=1.0.1
+make build VERSION=1.1.0
 ```
 
 Or directly:
@@ -316,6 +325,7 @@ There is no `docs/archive/` directory.
 | [guide.md](guide.md) | Proxy, env, DNS, IP warmup, operations, rate limiting, backup, ports, image tag |
 | [SECURITY.md](../SECURITY.md) | Private reporting channel, supported versions, scope |
 | [LICENSE](../LICENSE) | AGPL-3.0 full text |
+| [NOTICE](../NOTICE) | Copyright holder and third-party attributions |
 | [deploy/docker-compose.yml](../deploy/docker-compose.yml) + proxies | Apache + nginx/Caddy/Traefik under [deploy/](../deploy/) |
 | [deploy/.env.example](../deploy/.env.example) | Public env template; full reference in [guide.md](guide.md) |
 | [CHANGELOG.md](../CHANGELOG.md) | Keep a Changelog |
@@ -344,7 +354,7 @@ to prose.
 | Mail path | [build/postfix-config.sh](../build/postfix-config.sh) |
 | Panel routes | [internal/web/web.go](../internal/web/web.go) |
 | Backup / restore, domain export | [internal/backup/](../internal/backup/), [cmd/selfpost-backup/](../cmd/selfpost-backup/) |
-| Sessions | [internal/store/sessions.go](../internal/store/sessions.go), [internal/web/session.go](../internal/web/session.go) |
+| Sessions | [internal/store/sessions.go](../internal/store/sessions.go), [internal/web/auth/session.go](../internal/web/auth/session.go) |
 | Log rotation, reload | [build/logrotate-mail.conf](../build/logrotate-mail.conf), [build/logrotate-loop.sh](../build/logrotate-loop.sh), [build/postfix-cert-reload.sh](../build/postfix-cert-reload.sh) |
 | Deploy | [deploy/docker-compose.yml](../deploy/docker-compose.yml), [build/Dockerfile](../build/Dockerfile) |
 | Operator checklist | [§ User-facing deliverables](#user-facing-deliverables); detail — [guide.md](guide.md) |