chore(release): website updates for v1.0.0

[bigpuritz]

Closes #104.

Release sweep for Plugwerk v1.0.0 — the first stable release. Follows RELEASE_CHECKLIST.md.

Phase status

Phase	Status
1. OpenAPI sync	Already done — auto-sync PR #102 merged into main before this PR was opened (public/api-docs/openapi.yaml, +712 / −0, pure additive).
2. Compose mirror	Already current — public/deploy/docker-compose.yml matches plugwerk-server/.../src/dist/docker-compose.yml@v1.0.0 byte-for-byte.
3. Hardcoded version bump	Done — server/deployment.mdx example tag bumped from 1.0.0-beta.2 to 1.0.0-beta.3 in two places.
4. Release banner	Done — src/pages/index.astro updated to version: "1.0.0". The banner shows RELEASE / 1.0.0.
5. Release-notes page	Done — src/content/docs/releases/1.0.0.mdx (new), releases/index.mdx table extended.
6. API reference	No action — auto-renders from the synced spec.
7. Milestone hygiene	Milestone 1.0.0 created and assigned. Beta.3 milestone closes once PR #93 merges.
8. Ship + verify	This PR.

What's in the release notes

User-facing summary (full content in the new MDX page):

• S3-compatible object storage backend (#191) — opt-in
• Admin scheduler dashboard — enable/disable, dry-run, run-now per scheduled job
• Scheduled orphan-artifact reaper + storage/DB consistency check with ShedLock
• Operator-uploadable branding — top bar, login, favicon
• Effective-config admin view (read-only plugwerk.* with secrets redacted)
• general.site_name wired through the UI
• Security: fast-fail at startup when PLUGWERK_AUTH_ENCRYPTION_KEY cannot decrypt stored OIDC client secrets

Breaking change called out:

• Client SDK: PlugwerkUpdateChecker.checkForUpdates(...) now takes a typed InstalledPluginRef (was Map<String, String>). Existing snippets in client-sdk/configuration.mdx and client-sdk/migration.mdx will become stale — see follow-ups below.

Follow-ups (NOT in this PR — track separately)

These are listed in #104 and are intentionally out of scope so this PR stays the release sweep:

1. SDK reference update for InstalledPluginRef — mirror of docs: update SDK reference for PlugwerkInstaller PluginManager-lifecycle SPI (plugwerk#424) #83 / PR docs(client-sdk): document installer load+start lifecycle and uninstall (#83) #92 for the PlugwerkInstaller rework. Existing Map.of(...) snippets in client-sdk/configuration.mdx (Usage Examples block) and client-sdk/migration.mdx need migration.
2. S3 storage configuration page — the new env vars (PLUGWERK_STORAGE_* family, exact names from the synced OpenAPI / .env.example) deserve their own section in server/configuration.mdx, analog to how the SSRF guard got one in docs(server): document the OIDC SSRF guard env vars (#88) #93.
3. Scheduler / branding admin pages — if a server-admin docs section grows, these features warrant short walkthroughs.

Test plan

• npm run format clean
• npm run format:check clean
• npm run build clean (32 pages built; 1 new release page)
• AGENTS.md ADR/internal-link grep returns 0 hits in newly added content
• Banner renders RELEASE / 1.0.0 and the migrationUrl resolves to /releases/1.0.0/#upgrade-notes
• slug: releases/1.0.0 frontmatter override works (/releases/1.0.0/ not /releases/100/)
• Reviewer: pull, npm run dev, visit /, verify the banner reads RELEASE / 1.0.0 in both themes with three working links
• Reviewer: visit /releases/1.0.0/, verify Highlights / Breaking changes / Upgrade notes / Other notable changes sections render
• Reviewer: visit /releases/, verify the new row appears at the top of the table
• Reviewer: visit /server/deployment/, verify the example tag now reads 1.0.0-beta.3
• Reviewer: after merge, watch the deploy run and smoke-test https://www.plugwerk.io