v1.1.0:8 — admin-gate whole-DB routes + AI custom-URL providers; SSRF guard

Multi-user authorization hardening from a full security evaluation (EVALUATION.md):

- P0: /api/settings/{export,import}-db are now admin-only. Previously any signed-in user could download the whole instance DB (all bcrypt hashes + plaintext AI keys) or replace it wholesale. Per-user CSV export/import stays open.

- AI custom-URL providers (Ollama, OpenAI-compatible) are now admin-only, and every server fetch to a user-supplied URL passes through assertSafeProviderUrl (blocks link-local/cloud-metadata; private LAN allowed by design). Fixed-URL cloud providers stay per-user. Removed the dead legacy /api/ai/config route.

- Dev: fixed broken quick-start (added npm run create-admin; rewrote README; dropped dead CLAUDE_API_KEY) and the export-db 0-byte path resolution (resolveDatabasePath now matches Prisma).

ExVer bumped to 1.1.0:8 (no schema/data migration). Tests 197 pass, build green, tsc clean.

start9/0.4/startos/versions/index.ts

@@ -13,6 +13,7 @@ import { v_1_1_0_4 } from './v1.1.0.4'
 import { v_1_1_0_5 } from './v1.1.0.5'
 import { v_1_1_0_6 } from './v1.1.0.6'
 import { v_1_1_0_7 } from './v1.1.0.7'
+import { v_1_1_0_8 } from './v1.1.0.8'
 
 /**
  * Version graph for the `proof-of-work` package.
@@ -48,9 +49,12 @@ import { v_1_1_0_7 } from './v1.1.0.7'
  * v1.1.0:7 — Exercise-history popup auto-loads more rows on scroll
  *            (switched from a flaky IntersectionObserver-in-popup to
  *            a plain scroll listener with 300px lookahead).
+ * v1.1.0:8 — Multi-user authz hardening: whole-instance DB export/import
+ *            admin-only; custom-URL AI providers (Ollama / OpenAI-compatible)
+ *            admin-only + SSRF guard; dead legacy /api/ai/config removed.
  */
 export const versionGraph = VersionGraph.of({
-  current: v_1_1_0_7,
+  current: v_1_1_0_8,
   other: [
     v_1_0_0_1,
     v_1_0_0_2,
@@ -65,5 +69,6 @@ export const versionGraph = VersionGraph.of({
     v_1_1_0_4,
     v_1_1_0_5,
     v_1_1_0_6,
+    v_1_1_0_7,
   ],
 })