release: v1.1.3 — dual-domain separation and URL options

Add admin/image domain separation with host isolation middleware,
optional hide-folder public URLs, GitHub release update check, and
Lucky/Nginx deployment docs. Switch license to GPL-3.0-only.

server/middleware/00-host-isolation.ts

@@ -0,0 +1,7 @@
+import { shouldBlockImageHostRequest } from '../utils/host-isolation'
+
+export default defineEventHandler((event) => {
+  if (shouldBlockImageHostRequest(event)) {
+    throw createError({ statusCode: 404, statusMessage: 'Not Found' })
+  }
+})

server/middleware/01-serve-image.ts

@@ -8,7 +8,9 @@ export default defineEventHandler(async (event) => {
   const method = getMethod(event)
   if (method !== 'GET' && method !== 'HEAD') return
 
-  const key = requestPathToImageKey(getRequestURL(event).pathname)
+  const key = requestPathToImageKey(getRequestURL(event).pathname, {
+    hideFolder: isHideFolderInUrl(event)
+  })
   if (!key) return
 
   return serveImageByKey(event, key)