Web demo prep: version 3.11.0 cut, deploy pipeline learns per-target gating

Version cut. 3.10.2 → 3.11.0 across the husky, api, app, e2e, and app.config files. Standard dev-to-staging promotion bump.

Per-target gating in deploy. The deploy workflow now emits a frontend_gated flag per environment, and the steps that wait for the edge function and run smoke tests honor it. One pipeline, two access models — no more one-size-fits-all smoke that fights whichever target it's pointed at.

Smoke test gate-aware. The smoke script reads the same flag and switches between checking for a public 200 response and the gated 401-then-200 response, so the test passes for the right reason on each target instead of being lenient enough to pass both.