ci(semantic-release): auto versioning via semantic-release

- .releaserc.json: commit-analyzer + release-notes-generator + changelog
  + exec (prepare) + git + github plugins.
- .semrel/prepare.mjs: syncs next release version into package.json AND
  flake.nix before the release commit — guarantees a fresh Nix store path
  on every deploy (fixes the trap where a source change without a version
  bump reused the same store path and CI silently deployed stale code).
- release.yml: runs semantic-release on main push (GITHUB_TOKEN,
  isolated /tmp/sr-tools install so package.json/bun.lock stay clean).
- Release commit (no [skip ci]) triggers deploy.yml → auto build+deploy.
- Baseline tag v1.1.1 backfilled at current HEAD.

.semrel/prepare.mjs

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+/**
+ * Prepare script for semantic-release: synchronises the package version
+ * across package.json and flake.nix before the release commit.
+ *
+ * getVersion() keeps package.json as the source of truth when semver has
+ * not run yet (e.g. first bootstrap) — after that, nextRelease.version
+ * is passed as argv[2] and everything is aligned to it.
+ *
+ * Fixes the TeleUploader Nix deploy trap: a source change without a
+ * version bump made Nix reuse the same store path, so CI reported success
+ * while the VPS profile stayed on the old build. By bumping flake.nix's
+ * `version` on every release, the Nix derivation always changes and the
+ * store path is always fresh.
+ */
+import { readFileSync, writeFileSync } from 'node:fs';
+
+const nextVersion = process.argv[2];
+
+// --- package.json ---
+const pkgPath = 'package.json';
+const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
+if (nextVersion) pkg.version = nextVersion;
+writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+
+// --- flake.nix ---
+const flakePath = 'flake.nix';
+let flake = readFileSync(flakePath, 'utf8');
+const target = nextVersion ?? pkg.version;
+const replaced = flake.replace(/version = "\d+\.\d+\.\d+";/, `version = "${target}";`);
+if (!replaced.includes(`version = "${target}";`)) {
+  throw new Error(`prepare.mjs: could not update version in ${flakePath} (pattern not found)`);
+}
+writeFileSync(flakePath, replaced);
+
+console.log(`prepare.mjs: versions synced to ${target}`);