feat(release): prepare 1.1.0 candidate

site/vite.config.ts

@@ -1,7 +1,40 @@
 import { defineConfig } from 'vite'
 import react from '@vitejs/plugin-react'
+import { cpSync, mkdirSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const siteRoot = dirname(fileURLToPath(import.meta.url))
+const safePublicFiles = [
+  '.well-known/assetlinks.json',
+  'accept-invite.css',
+  'accept-invite.html',
+  'accept-invite.js',
+  'accept-invite/index.html',
+  'download.html',
+  'favicon.svg',
+  'legal.css',
+  'privacy/index.html',
+  'terms/index.html',
+  'delete-account/index.html',
+]
 
 export default defineConfig({
-  plugins: [react()],
+  // `public/releases` contains retained historical binaries. It is deliberately
+  // outside the build graph; only this non-binary allowlist can reach dist.
+  publicDir: false,
+  plugins: [
+    react(),
+    {
+      name: 'copy-safe-public-files',
+      closeBundle() {
+        for (const relativePath of safePublicFiles) {
+          const destination = join(siteRoot, 'dist', relativePath)
+          mkdirSync(dirname(destination), { recursive: true })
+          cpSync(join(siteRoot, 'public', relativePath), destination, { errorOnExist: true })
+        }
+      },
+    },
+  ],
   base: './',
 })