Release 3.1.1: Instagram works on a fresh install; printable guide rewritten

.env.example

@@ -25,6 +25,10 @@ FORGECRM_JWT_SECRET=
 FORGECRM_ENCRYPTION_KEY=
 # Any random string; you paste the same value into Meta's webhook setup.
 META_WEBHOOK_VERIFY_TOKEN=
+# Encrypts Instagram tokens and the Social section's AI keys. Any long random
+# string: openssl rand -hex 32. Saving an Instagram credential is refused while
+# it is empty. ⚠ Same rule as FORGECRM_ENCRYPTION_KEY: back it up, never change it.
+SOCIAL_ENCRYPTION_KEY=
 
 # ─── Database ────────────────────────────────────────────────────────────────
 # With the bundled compose stack, leave the host as the service name.

CHANGELOG.md

@@ -17,6 +17,29 @@ re-run and leaves `.env` and your database alone. Pin to a specific release with
 
 ## [Unreleased]
 
+## [3.1.1] — 2026-10-26
+
+### Fixed
+
+- **Instagram could not be connected on a fresh install.** The Social section refuses to save
+  Instagram credentials without `SOCIAL_ENCRYPTION_KEY`, and nothing generated it, so every new install
+  needed a hand edit of `.env` that no page mentioned. The installer and `generate-secrets.sh` now
+  generate it with the other secrets; re-run `./install.sh` on an existing install to fill it in.
+  An existing value is never changed.
+- The installer's closing "Next steps" named `Admin Settings → WhatsApp Accounts`, a menu that no
+  longer exists. It now says `Settings → WhatsApp → Accounts`, and adds where to connect Instagram.
+- **The installer hung forever, silently, on Alpine Linux** (and in `docker:dind`) right after
+  "install name". BusyBox's `lsof` ignores its arguments and reports success, so every port looked
+  taken and the search for a free one never ended. It now uses `netstat` there, and stops with a clear
+  message if a hundred ports in a row read as busy.
+
+### Documentation
+
+- **The printable installation guide is rewritten for this release.** The previous PDF dated from
+  before 1.0.0 and sent people to Admin Settings → Domain, which 3.0.0 removed. New: the download
+  bundle, a chapter on connecting Instagram, and domain checks that use `curl`. Its HTML source is now
+  in `docs/guide/`, and `scripts/make-guide.sh` rebuilds the PDF from it.
+
 ## [3.1.0] — 2026-10-26
 
 **Fresh installs work again.** Every new install of 3.0.0 stopped while pulling images, because the
@@ -400,7 +423,8 @@ Published as multi-architecture images (`linux/amd64` and `linux/arm64`) at
 - Playwright end-to-end tests are not run in CI — they need the full stack and browser binaries, so
   run them locally against a live install.
 
-[Unreleased]: https://github.com/Forgemind-git/ForgeGrowth-OSS/compare/v3.1.0...HEAD
+[Unreleased]: https://github.com/Forgemind-git/ForgeGrowth-OSS/compare/v3.1.1...HEAD
+[3.1.1]: https://github.com/Forgemind-git/ForgeGrowth-OSS/compare/v3.1.0...v3.1.1
 [3.1.0]: https://github.com/Forgemind-git/ForgeGrowth-OSS/compare/v3.0.0...v3.1.0
 [3.0.0]: https://github.com/Forgemind-git/ForgeGrowth-OSS/compare/v1.0.1...v3.0.0
 [2.0.0]: https://github.com/Forgemind-git/ForgeGrowth-OSS/compare/v1.0.1...v2.0.0

README.md

@@ -142,8 +142,8 @@ follow-up?"*.
 ### Already on a server with Docker? One command.
 
 ```bash
-bash -c "$(curl -fsSL https://raw.githubusercontent.com/Forgemind-git/ForgeGrowth-OSS/v3.1.0/scripts/install.sh)" -- \
-  --version v3.1.0 --domain crm.example.com --yes
+bash -c "$(curl -fsSL https://raw.githubusercontent.com/Forgemind-git/ForgeGrowth-OSS/v3.1.1/scripts/install.sh)" -- \
+  --version v3.1.1 --domain crm.example.com --yes
 ```
 
 Swap `crm.example.com` for your domain. That single command is the entire install: it pulls the
@@ -238,7 +238,7 @@ Two ways in, same result. Pick either.
 
 Everything in one file, with a folder for each operating system.
 
-1. Download **[`forge-growth-v3.1.0.zip`](https://github.com/Forgemind-git/ForgeGrowth-OSS/raw/main/dist/forge-growth-v3.1.0.zip)**
+1. Download **[`forge-growth-v3.1.1.zip`](https://github.com/Forgemind-git/ForgeGrowth-OSS/raw/main/dist/forge-growth-v3.1.1.zip)**
    (~145 KB). It is in this repository under [`dist/`](./dist), and also attached to the
    [releases page](https://github.com/Forgemind-git/ForgeGrowth-OSS/releases/latest) — two hosts, so
    one of them being down or rate-limiting you is not the end of the install.
@@ -264,8 +264,8 @@ bash -c "$(curl -fsSL https://raw.githubusercontent.com/Forgemind-git/ForgeGrowt
 **On a server with a real domain**, pinned to a release and asking nothing at all:
 
 ```bash
-bash -c "$(curl -fsSL https://raw.githubusercontent.com/Forgemind-git/ForgeGrowth-OSS/v3.1.0/scripts/install.sh)" -- \
-  --version v3.1.0 --domain crm.example.com
+bash -c "$(curl -fsSL https://raw.githubusercontent.com/Forgemind-git/ForgeGrowth-OSS/v3.1.1/scripts/install.sh)" -- \
+  --version v3.1.1 --domain crm.example.com
 ```
 
 ---

SECURITY.md

@@ -17,7 +17,7 @@ re-run and leaves `.env` and your database alone:
 
 ```bash
 ./install.sh                  # move to the current release
-./install.sh --version v3.1.0 # or pin to a specific one
+./install.sh --version v3.1.1 # or pin to a specific one
 ```
 
 ## Reporting a vulnerability

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forgecrm-backend",
-  "version": "3.1.0",
+  "version": "3.1.1",
   "license": "MIT",
   "description": "ForgeChat backend API for WhatsApp chat viewer",
   "main": "src/index.js",