Modernize admin UI and harden provider contracts

Adopt Web Awesome for consistent accessible controls while aligning production ASR, App Attest, and runtime dependency safeguards.

src/main/kotlin/com/osglab/account/config/AppConfig.kt

@@ -84,7 +84,7 @@ data class AppConfig(
                 volcengine = VolcengineConfig(
                     endpoint = config.valueOrDefault(
                         "app.providers.volcengine.endpoint",
-                        "wss://openspeech.bytedance.com/api/v3/sauc/bigmodel_async",
+                        "wss://openspeech.bytedance.com/api/v3/sauc/bigmodel",
                     ),
                     appId = config.optionalValue("app.providers.volcengine.appId"),
                     accessToken = config.optionalValue("app.providers.volcengine.accessToken"),

src/main/resources/application.yaml

@@ -54,7 +54,7 @@ app:
     referralBindingDays: "$REFERRAL_BINDING_DAYS:7"
   providers:
     volcengine:
-      endpoint: "$VOLCENGINE_ASR_ENDPOINT:wss://openspeech.bytedance.com/api/v3/sauc/bigmodel_async"
+      endpoint: "$VOLCENGINE_ASR_ENDPOINT:wss://openspeech.bytedance.com/api/v3/sauc/bigmodel"
       appId: "$VOLCENGINE_APP_ID:"
       accessToken: "$VOLCENGINE_ACCESS_TOKEN:"
       apiKey: "$VOLCENGINE_API_KEY:"

src/test/kotlin/com/osglab/account/config/DeploymentConsistencyTest.kt

@@ -39,6 +39,28 @@ class DeploymentConsistencyTest : FunSpec({
         openApi shouldContain "referralCode"
     }
 
+    test("provider defaults and Apple integrity contract stay production compatible") {
+        val providerConfigurations = listOf(
+            root.read("src/main/kotlin/com/osglab/account/config/AppConfig.kt"),
+            root.read("src/main/resources/application.yaml"),
+            root.read(".env.example"),
+            root.read("compose.yaml"),
+        )
+        providerConfigurations.forEach { configuration ->
+            configuration shouldContain "wss://openspeech.bytedance.com/api/v3/sauc/bigmodel"
+            configuration shouldNotContain "bigmodel_async"
+        }
+
+        val openApi = root.read("docs/openapi.yaml")
+        openApi shouldContain "osg-app-attest-v1"
+        openApi shouldContain "purpose=apple-sign-in"
+        openApi shouldContain "identity_token_sha256=<identity-token-digest>"
+        openApi shouldContain "authorization_code_sha256=<authorization-code-digest>"
+        openApi shouldContain "nonce_sha256=<raw-nonce-digest>"
+        openApi shouldContain "including the final line feed"
+        openApi shouldContain "unpadded Base64URL"
+    }
+
     test("production Compose reuses private MySQL and hardens the application container") {
         val compose = root.read("compose.yaml")
 
@@ -84,7 +106,9 @@ class DeploymentConsistencyTest : FunSpec({
         dockerfile shouldContain "http://127.0.0.1:8080/health/ready"
         dockerfile shouldNotContain "ENTRYPOINT [\"sh\""
         dockerfile shouldNotContain "jansi.tmpdir"
+        build shouldContain "configurations.configureEach"
         build shouldContain "exclude(group = \"org.fusesource.jansi\", module = \"jansi\")"
+        build shouldContain "tasks.register(\"verifyRuntimeClasspath\")"
     }
 
     test("OpenResty proxies HTTP WebSocket invitations and both AASA paths safely") {