Modernize admin UI and harden provider contracts

Adopt Web Awesome for consistent accessible controls while aligning production ASR, App Attest, and runtime dependency safeguards.

docs/openapi.yaml

@@ -1079,9 +1079,15 @@ components:
       additionalProperties: false
       required: [identityToken, authorizationCode, nonce]
       properties:
-        identityToken: { type: string }
-        authorizationCode: { type: string }
-        nonce: { type: string }
+        identityToken:
+          type: string
+          description: Identity token returned by Sign in with Apple.
+        authorizationCode:
+          type: string
+          description: Single-use authorization code returned by Sign in with Apple.
+        nonce:
+          type: string
+          description: Raw nonce whose lowercase SHA-256 hex digest was sent to Apple.
         deviceCheckToken:
           type: ["string", "null"]
           description: Ephemeral DeviceCheck token; never persisted in plaintext.
@@ -1091,6 +1097,23 @@ components:
             - type: "null"
     AppAttestAssertion:
       type: object
+      description: |
+        For Apple sign-in, generate the assertion with `clientDataHash` equal to
+        SHA-256 of the exact UTF-8 payload below, including the final line feed:
+
+        ```
+        osg-app-attest-v1
+        purpose=apple-sign-in
+        challenge=<challenge>
+        identity_token_sha256=<identity-token-digest>
+        authorization_code_sha256=<authorization-code-digest>
+        nonce_sha256=<raw-nonce-digest>
+        ```
+
+        `challenge` is the Base64URL value returned by `/v1/integrity/challenges`.
+        Each digest is SHA-256 of the corresponding UTF-8 request value, encoded
+        as unpadded Base64URL. The server reconstructs this payload and never
+        trusts a client-supplied hash.
       additionalProperties: false
       required: [keyId, challengeId, challenge, assertion]
       properties: