Update admin theme/layout and refresh README details.

Align the project baseline with the latest admin interface styling and layout structure while documenting setup and usage updates in README.

docs/TZ.md

@@ -0,0 +1,9 @@
+# Compton Technical Specification
+
+The canonical technical specification is maintained in project planning artifacts and reflected in the implementation constraints in this repository.
+
+This project intentionally follows:
+- Modular monolith backend
+- FSD-like frontend layers
+- Mandatory test gates (unit/integration/component/e2e)
+- Security-first auth/token handling

docs/release-regression-checklist.md

@@ -0,0 +1,14 @@
+# MVP Regression Checklist
+
+This checklist mirrors the required release scenarios.
+
+1. Landing hero/marquee and reduced-motion behavior.
+2. Register -> verify -> login -> profile edit -> logout.
+3. Forgot password -> reset -> login.
+4. Admin publish content -> public slug availability.
+5. Admin blocks user -> blocked user login denied.
+6. Pending user cannot access `/profile`.
+7. Refresh token rotation and old token rejection.
+8. IDOR check: user A cannot access user B.
+9. Admin cannot demote/block self; last admin protected.
+10. Avatar upload rejects invalid MIME/oversize/SVG.

docs/secrets-recovery.md

@@ -0,0 +1,30 @@
+# Install Secrets Recovery
+
+This project keeps runtime installation secrets in `apps/api/data/secrets/install.env`.
+
+## Important
+
+- Do not rotate `POSTGRES_PASSWORD`, `JWT_ACCESS_SECRET`, or `JWT_REFRESH_PEPPER` automatically after first bootstrap.
+- A mismatch between `install.env` and initialized Postgres volume can break database access.
+
+## Safe recovery steps
+
+1. Stop services:
+   - `docker compose down`
+2. Restore `apps/api/data/secrets/install.env` from backup.
+3. Start services:
+   - `docker compose up -d --build`
+
+If backup is unavailable, you have two options:
+
+- Preferred: recover credentials directly from running database/admin secret reveal in another environment.
+- Last resort: reset local volumes and lose local dev data:
+  - `docker compose down -v`
+  - `python apps/api/scripts/bootstrap_install.py`
+  - `docker compose up -d --build`
+
+## Dev access ports
+
+To expose DB/Redis/MinIO to host tools:
+
+- `docker compose -f docker-compose.yml -f docker-compose.dev-ports.yml up -d`

docs/security-checklist.md

@@ -0,0 +1,20 @@
+# Security Checklist (MVP Pre-Production)
+
+- [x] Access JWT is memory-only in frontend state (no sessionStorage/localStorage persistence).
+- [x] Refresh token is HttpOnly/Secure/SameSite cookie on `/api/v1/auth` path.
+- [x] Auth endpoints implemented with neutral anti-enumeration messaging.
+- [x] Origin/Referer validation is enforced for auth endpoints.
+- [x] Authenticated/admin route guards and role checks are enforced, including `SUPERUSER_ONLY` checks for critical endpoints.
+- [x] Content sanitization is enabled for CMS HTML body.
+- [x] Security headers configured in `infra/nginx/default.conf`.
+- [x] CI includes dependency audit, Bandit, and gitleaks scans.
+- [x] Settings runtime supports `data/compton_settings.json` with env lock behavior.
+- [x] Admin audit feed is persisted to `data/logs/admin-audit.jsonl`.
+- [x] Install secrets bootstrap is enabled (`apps/api/data/secrets/install.env`) and locked after first run.
+- [x] Database, Redis and MinIO are internal by default in base docker compose.
+- [x] `refresh` validates user status and rate limit is checked before token rotation.
+- [x] CMS sanitization enforces allowed URL protocols (`http`, `https`, `mailto`).
+- [x] Admin password create/reset uses shared password policy validators.
+- [ ] Production docs endpoint switch (`ENABLE_DOCS=false`) validated in staging/prod env.
+- [ ] HSTS behavior validated behind TLS ingress in staging/prod.
+- [ ] Recovery runbook for lost `install.env` tested (`docs/secrets-recovery.md`).