Harden admin deployment and local acceptance

Enforce mTLS and least-privilege runtime boundaries while adding repeatable MySQL 8.4 and Docker smoke checks that require no production secrets.

Dockerfile

@@ -1,10 +1,13 @@
 FROM gradle:9.6.1-jdk21-alpine AS build
-RUN mkdir -p /workspace && chown gradle:gradle /workspace
+RUN apk add --no-cache nodejs npm \
+    && mkdir -p /workspace \
+    && chown gradle:gradle /workspace
 WORKDIR /workspace
 
 COPY --chown=gradle:gradle . .
 USER gradle
-RUN ./gradlew --no-daemon --stacktrace installDist
+RUN --mount=type=cache,target=/home/gradle/.gradle,uid=1000,gid=1000 \
+    ./gradlew --no-daemon --no-configuration-cache --stacktrace installDist
 
 FROM eclipse-temurin:21-jre-alpine
 RUN addgroup -S -g 10001 app \
@@ -21,6 +24,6 @@ EXPOSE 8080
 STOPSIGNAL SIGTERM
 
 HEALTHCHECK --interval=30s --timeout=3s --start-period=30s --retries=3 \
-    CMD wget -q -O /dev/null http://127.0.0.1:8080/health/live || exit 1
+    CMD wget -q -O /dev/null http://127.0.0.1:8080/health/ready || exit 1
 
 ENTRYPOINT ["/app/bin/OSGAccountServer"]