chore(release): v1.0.1

[github-actions]

Release v1.0.1

Automated release pull request for v1.0.1, drafted from the commits merged since
v1.0.0. Nothing is tagged or published until this pull request is merged.

What this changes

• version 1.0.0 -> 1.0.1 in package.json,
  packages/backend/package.json and packages/frontend/package.json. The backend
  manifest is read at runtime, so GET /api/health reports the new version.
• A ## [1.0.1] - 2026-09-15 section in CHANGELOG.md, placed above the previous
  release and merged with any notes already staged for this one.

Review checklist

• The changelog entry is accurate and readable. Edit CHANGELOG.md directly on this
  branch before merging.
• The version follows SemVer for the changes included.
• Required status checks are green.

What happens on merge

The merge commit is tagged v1.0.1 and the
Release pipeline runs: it creates the GitHub
Release with generated notes, attaches the frontend bundle, and publishes the
custotal-backend:v1.0.1 (API), custotal-backend:v1.0.1-tools (migrations) and
custotal-frontend:v1.0.1 container images to GHCR. Every image carries the same tag, so
CUSTOTAL_TAG=v1.0.1 pins the whole stack, and no floating latest is published.

Re-dispatching Release: prepare rebuilds this branch from main and
overwrites edits made here, so prefer to fix the branch in place.

Generated changelog draft

[1.0.1] - 2026-09-15

Security

• Email validation hardening — an email address is now checked with a linear-time validator that
  caps the field at the RFC 5321 maximum (254 characters) before any matching, instead of a pattern
  that backtracked.

Documentation

• docs: update changelog

Maintenance

• chore: update release workflow
• chore: add github pages
• chore: fix codeql reported issues
• chore(deps-dev): bump the root-dev-dependencies group across 1 directory with 4 updates
• chore: update readme
• chore(deps): bump the github-actions group across 1 directory with 4 updates
• chore(deps): bump nodemailer from 10.0.3 to 10.0.8