Harden admin deployment and local acceptance

Enforce mTLS and least-privilege runtime boundaries while adding repeatable MySQL 8.4 and Docker smoke checks that require no production secrets.

deploy/smoke/README.md

@@ -0,0 +1,28 @@
+# Local Docker smoke verification
+
+Run from any directory:
+
+```bash
+/Users/rocky/Documents/OSGAccountServer/deploy/smoke-local.sh
+```
+
+Requirements: Docker with Compose v2, `curl`, `openssl`, and Python 3.
+
+The runner builds the current checkout, creates an isolated MySQL 8.4 project,
+generates one-time keys and administrator credentials, and uses an internal
+Docker network. Apple, DeepSeek, and Volcengine endpoints point to the
+container's closed loopback port, so no provider request can leave the project.
+
+The checks cover:
+
+- successful Flyway V1-V8 history and `/health/ready`;
+- hidden admin routes without the trusted edge header;
+- TOTP login, cookies, CSRF, role denial, core reads, grants, and logout;
+- a 101-row ledger fixture that requires a second cursor page;
+- an exact per-table runtime grant matrix;
+- denied `UPDATE` and `DELETE` on ledger, audit, and grant history.
+
+Containers, the named volume, the local smoke image, cookie jars, generated
+keys, and administrator credentials are removed on exit. On failure, only
+recent container status and logs remain in the printed temporary diagnostics
+path.