Modernize admin UI and harden provider contracts

Adopt Web Awesome for consistent accessible controls while aligning production ASR, App Attest, and runtime dependency safeguards.

src/test/kotlin/com/osglab/account/config/DeploymentConsistencyTest.kt

@@ -39,6 +39,28 @@ class DeploymentConsistencyTest : FunSpec({
         openApi shouldContain "referralCode"
     }
 
+    test("provider defaults and Apple integrity contract stay production compatible") {
+        val providerConfigurations = listOf(
+            root.read("src/main/kotlin/com/osglab/account/config/AppConfig.kt"),
+            root.read("src/main/resources/application.yaml"),
+            root.read(".env.example"),
+            root.read("compose.yaml"),
+        )
+        providerConfigurations.forEach { configuration ->
+            configuration shouldContain "wss://openspeech.bytedance.com/api/v3/sauc/bigmodel"
+            configuration shouldNotContain "bigmodel_async"
+        }
+
+        val openApi = root.read("docs/openapi.yaml")
+        openApi shouldContain "osg-app-attest-v1"
+        openApi shouldContain "purpose=apple-sign-in"
+        openApi shouldContain "identity_token_sha256=<identity-token-digest>"
+        openApi shouldContain "authorization_code_sha256=<authorization-code-digest>"
+        openApi shouldContain "nonce_sha256=<raw-nonce-digest>"
+        openApi shouldContain "including the final line feed"
+        openApi shouldContain "unpadded Base64URL"
+    }
+
     test("production Compose reuses private MySQL and hardens the application container") {
         val compose = root.read("compose.yaml")
 
@@ -84,7 +106,9 @@ class DeploymentConsistencyTest : FunSpec({
         dockerfile shouldContain "http://127.0.0.1:8080/health/ready"
         dockerfile shouldNotContain "ENTRYPOINT [\"sh\""
         dockerfile shouldNotContain "jansi.tmpdir"
+        build shouldContain "configurations.configureEach"
         build shouldContain "exclude(group = \"org.fusesource.jansi\", module = \"jansi\")"
+        build shouldContain "tasks.register(\"verifyRuntimeClasspath\")"
     }
 
     test("OpenResty proxies HTTP WebSocket invitations and both AASA paths safely") {