Modernize admin UI and harden provider contracts

Adopt Web Awesome for consistent accessible controls while aligning production ASR, App Attest, and runtime dependency safeguards.

build.gradle.kts

@@ -72,6 +72,29 @@ kotlin {
     }
 }
 
+configurations.configureEach {
+    // Jansi is Windows-only console coloring here; excluding it keeps /tmp noexec-safe.
+    exclude(group = "org.fusesource.jansi", module = "jansi")
+}
+
+val verifyRuntimeClasspath = tasks.register("verifyRuntimeClasspath") {
+    group = "verification"
+    description = "Reject native console libraries that cannot run with a noexec temporary directory"
+
+    doLast {
+        val forbidden = configurations.named("runtimeClasspath").get()
+            .resolvedConfiguration
+            .resolvedArtifacts
+            .filter {
+                it.moduleVersion.id.group == "org.fusesource.jansi" &&
+                    it.moduleVersion.id.name == "jansi"
+            }
+        check(forbidden.isEmpty()) {
+            "Runtime classpath must not contain org.fusesource.jansi:jansi"
+        }
+    }
+}
+
 dependencies {
     val ktorVersion = "3.5.2"
     val exposedVersion = "1.4.0"
@@ -84,10 +107,7 @@ dependencies {
     implementation("io.ktor:ktor-server-auth-jvm:$ktorVersion")
     implementation("io.ktor:ktor-server-auth-jwt-jvm:$ktorVersion")
     implementation("io.ktor:ktor-server-status-pages-jvm:$ktorVersion")
-    implementation("io.ktor:ktor-server-call-logging-jvm:$ktorVersion") {
-        // Jansi is Windows-only console coloring here; excluding it keeps /tmp noexec-safe.
-        exclude(group = "org.fusesource.jansi", module = "jansi")
-    }
+    implementation("io.ktor:ktor-server-call-logging-jvm:$ktorVersion")
     implementation("io.ktor:ktor-server-rate-limit-jvm:$ktorVersion")
     implementation("io.ktor:ktor-server-websockets-jvm:$ktorVersion")
     implementation("io.ktor:ktor-server-forwarded-header-jvm:$ktorVersion")
@@ -145,6 +165,10 @@ tasks.processResources {
     dependsOn(adminWebResources)
 }
 
+tasks.named("check") {
+    dependsOn(verifyRuntimeClasspath)
+}
+
 tasks.register<JavaExec>("generateAdminCredentials") {
     group = "deployment"
     description = "Generate private admin bootstrap and operator handoff files"