Update admin theme/layout and refresh README details.

Align the project baseline with the latest admin interface styling and layout structure while documenting setup and usage updates in README.

apps/api/tests/core/test_media_signing.py

@@ -0,0 +1,38 @@
+from app.core.media_signing import build_signed_media_url, verify_signed_media
+from app.core.config import settings
+import time
+
+
+def test_build_and_verify_signed_media_url():
+    signed = build_signed_media_url("/api/v1/media/files/avatars/user/file.png")
+    assert signed is not None
+    assert "expires=" in signed
+    assert "sig=" in signed
+
+    path = "avatars/user/file.png"
+    query = signed.split("?", 1)[1]
+    params = dict(part.split("=") for part in query.split("&"))
+    assert int(params["expires"]) - int(time.time()) <= settings.media_url_ttl_seconds
+    assert verify_signed_media(path, int(params["expires"]), params["sig"])
+
+
+def test_build_signed_media_url_none():
+    assert build_signed_media_url(None) is None
+
+
+def test_verify_signed_media_rejects_expired_signature():
+    signed = build_signed_media_url("/api/v1/media/files/avatars/user/file.png")
+    assert signed is not None
+    path = "avatars/user/file.png"
+    query = signed.split("?", 1)[1]
+    params = dict(part.split("=") for part in query.split("&"))
+    assert not verify_signed_media(path, int(params["expires"]) - 10_000, params["sig"])
+
+
+def test_verify_signed_media_rejects_tampered_signature():
+    signed = build_signed_media_url("/api/v1/media/files/avatars/user/file.png")
+    assert signed is not None
+    path = "avatars/user/file.png"
+    query = signed.split("?", 1)[1]
+    params = dict(part.split("=") for part in query.split("&"))
+    assert not verify_signed_media(path, int(params["expires"]), "invalid")

apps/api/tests/core/test_media_signing_passthrough.py

@@ -0,0 +1,6 @@
+from app.core.media_signing import build_signed_media_url
+
+
+def test_build_signed_media_url_passthrough():
+    external = "https://cdn.example.com/avatar.png"
+    assert build_signed_media_url(external) == external

apps/api/tests/core/test_password_denylist.py

@@ -0,0 +1,5 @@
+from app.core.password_denylist import is_denied_password
+
+
+def test_password_denylist_blocks_common_password():
+    assert is_denied_password("password123")

apps/api/tests/core/test_storage.py

@@ -0,0 +1,5 @@
+from app.core.storage import ensure_bucket
+
+
+def test_ensure_bucket_noop_in_memory():
+    ensure_bucket()