Update admin theme/layout and refresh README details.

Align the project baseline with the latest admin interface styling and layout structure while documenting setup and usage updates in README.

docs/security-checklist.md

@@ -0,0 +1,20 @@
+# Security Checklist (MVP Pre-Production)
+
+- [x] Access JWT is memory-only in frontend state (no sessionStorage/localStorage persistence).
+- [x] Refresh token is HttpOnly/Secure/SameSite cookie on `/api/v1/auth` path.
+- [x] Auth endpoints implemented with neutral anti-enumeration messaging.
+- [x] Origin/Referer validation is enforced for auth endpoints.
+- [x] Authenticated/admin route guards and role checks are enforced, including `SUPERUSER_ONLY` checks for critical endpoints.
+- [x] Content sanitization is enabled for CMS HTML body.
+- [x] Security headers configured in `infra/nginx/default.conf`.
+- [x] CI includes dependency audit, Bandit, and gitleaks scans.
+- [x] Settings runtime supports `data/compton_settings.json` with env lock behavior.
+- [x] Admin audit feed is persisted to `data/logs/admin-audit.jsonl`.
+- [x] Install secrets bootstrap is enabled (`apps/api/data/secrets/install.env`) and locked after first run.
+- [x] Database, Redis and MinIO are internal by default in base docker compose.
+- [x] `refresh` validates user status and rate limit is checked before token rotation.
+- [x] CMS sanitization enforces allowed URL protocols (`http`, `https`, `mailto`).
+- [x] Admin password create/reset uses shared password policy validators.
+- [ ] Production docs endpoint switch (`ENABLE_DOCS=false`) validated in staging/prod env.
+- [ ] HSTS behavior validated behind TLS ingress in staging/prod.
+- [ ] Recovery runbook for lost `install.env` tested (`docs/secrets-recovery.md`).