FreshIdentity.Core 2.0.0-preview.0.3

• • Aardvark.Build (>= 2.0.7 && < 2.1.0)

- Migrate the solution, service, CLI, tests, and container images to .NET 10.
- Update Paket to 10.3.1 and Aardvark.Build/aardpack to 2.0.7.
- Enforce active global-admin authorization at the Core service boundary and reject non-HTTPS Production traffic after trusted proxy processing.
- Normalize OAuth2 authorization-code error responses and preserve safely bounded long legacy-password sign-in during automatic hash upgrades.
- Add fail-fast test scripts, Windows/Linux/macOS CI, coverage gates, and synchronized contributor and deployment documentation.
- Reduce CLI, OAuth2, rate-limiter, and account-state friction while expanding security and compatibility regression coverage.
- Require the `fresh` CLI to use atomic endpoint/API-key override pairs, reject conflicting endpoints, and never combine explicit values with cached credential counterparts.
- Parse and validate complete CLI commands before prompts or API calls, return stable `0`/`1`/`2`/`130` exit codes, and report concise bounded API errors without expected-failure stack traces.
- Split CLI parsing, execution, infrastructure, and credential persistence; serialize concurrent credential updates; preserve JSON-file property values; and add cross-platform regression coverage and operator guidance.
- Detect already-published NuGet versions before authentication so documentation-only release-note updates remain idempotent, while retaining authenticated pushes for new versions.
- Merge Windows, Linux, and macOS coverage in CI, enforce 100% line and 95% branch coverage, publish browsable reports, and add reproducible local coverage scripts.
- Expand deterministic in-process coverage to 382 tests across administration lifecycles, CLI, persistence and migration, API-client, password, GitHub, OAuth2, forward-auth, host-configuration, and continuation failure paths without calling external application services.
- Add pinned targeted mutation testing for authorization, administration, password, and scoped roles with an 80% breaking threshold and weekly/manual workflow, while documenting narrowly justified platform and compiler-generated coverage exclusions.
- Make the Signal client injectable and disposable without retargeting shared HTTP clients, dispose configured Signal transport at host shutdown, and remove unreachable API/OAuth/cookie guards exposed by the coverage review.
- Add an explicit versioned database schema and automatically migrate existing stores while replacing persisted API keys and OAuth client secrets with one-way hashes.
- Separate atomic persistence from the administration service and API-key authorization boundary; add safe account and credential projections, protocol capabilities, stable error codes, and structured secret-free audit events.
- Add account labels, bounded search/filter/pagination, enable/disable operations, ETag preconditions, and explicit protection against removing the final active global-admin API access path.
- Add complete API-key and OAuth client list/update/enable/disable/revoke lifecycles using non-secret credential identifiers, multiple OAuth redirects, and one-time creation secrets.
- Make administrator-created and reset passwords require a first-login change by default, remove their policy property when the credential is removed, and keep changes atomic with the password mutation.
- Align the `fresh` CLI with account, API-key, OAuth, password, ETag, paging, and lockout-override features while preserving JSON output, secure secret input, and documented exit codes.
- Remove unused role and API envelope declarations, consolidate persistence/projection/validation paths, and synchronize operator, contributor, API-example, help, migration, and security documentation.
Breaking changes: administrative SDK/JSON account and credential contracts now use explicit safe summary/detail DTOs; account listings are bounded by default; machine-credential creation responses separate one-time secrets from metadata; API-key revocation uses non-secret IDs; administrator password resets default to `mustChangePassword=true`; the unused granular role constants and API response envelope types were removed; and the database migration is forward-only for older binaries.