P0 is deployed and verified

v1.1.0 serves the actor, NodeInfo and WebFinger, answers Swagger with 404
and inbox junk with 400 and 401; migrations 1-3 ran and the unique
indexes exist.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

docs/ROADMAP.md

@@ -4,7 +4,7 @@ Written 2026-10-01 from the original 2023 code, the decePubClient UI, a federati
 
 ## Status
 
-- [ ] P0 Security baseline
+- [x] P0 Security baseline: v1.1.0, deployed and verified 2026-10-01
 - [ ] P1.1 Infrastructure and content model
 - [ ] P1.2 Social graph and timelines
 - [ ] P2 Mastodon client API