Upgrade GLPI runtime to upstream 11.0.11 (from 11.0.9). This is a security release (and replaces 11.0.10 which introduced a plugins-system regression). Fixed: High - authorization bypass in massive actions, privilege escalation via user cloning, improper rights checks in users deletion, SQL injection through form actors dropdown, 2FA deactivation/modification on users with higher privileges, reflected XSS in the dashboard search result widget; Medium - user names enumeration via the planning feature, missing authorization checks in the planning feature. Full changelog: https://github.com/glpi-project/glpi/milestone/93?closed=1 . Passwordless access, Chinese default UI, LazyCat Drive file interception and data persistence configuration are unchanged from the published version (data preservation across the upgrade was verified on real hardware).

Fixes per review feedback: 1) 'Application fails to start' - root cause was an interrupted MySQL first-time initialization leaving a half-initialized data directory (system tables present, application database missing), after which InnoDB aborts on every start with MY-012960 / Data Dictionary initialization failed; a pre-start guard now quarantines that state and re-initializes, resetting GLPI's install markers so it rebuilds its schema automatically. 2) UI language: the image's GLPI_LANG has no consumer, so the UI stayed English; language=zh_CN is now written after the first install using the app domain. 3) The user-menu debug toggle redirected to http://localhost (GLPI's factory url_base), producing a connection-refused page; url_base is now corrected to the real app domain on every start. 4) All screenshots recaptured on this build (8 desktop + 4 mobile).