OpenSylab v1.1.0 — UX overhaul + hardening

OpenSylab v1.1.0 — post-1.0 hardening + a full UX overhaul + an outward-presentation pass.

Post-1.0 hardening, a full UX overhaul, and an outward-presentation pass. Backed by
multi-agent audits (a 28-finding bug/inconsistency audit, a ~82-finding UX survey,
and a presentation review). 236 backend + 46 frontend + 8 E2E tests, all green in CI.

Added

• Toast notifications on every create / update / delete (writes are no longer silent).
• Read-only detail view (DetailModal) reachable by every role, including VIEWER.
• Responsive sidebar drawer — off-canvas navigation with a hamburger on small screens.
• URL-persisted filters & pagination on all list pages (deep-linkable, back-button-safe).
• Cross-entity navigation — Sample ↔ Order ↔ Result IDs are now links.
• Shared StatusBadge (rectangular tags) and a useModalA11y focus-trap hook.
• Playwright end-to-end suite (8 tests: login, navigation, API read, mobile drawer) wired into CI.
• CITATION.cff and a branded social-preview card.

Changed

• Activated the design-token layer — the project runs Tailwind v4, which ignored
  tailwind.config.js; a v4 @theme block now makes the Neo-Clinical palette and the
  JetBrains Mono data font actually render.
• Accessibility — focus-trapped modals with Esc/restore, aria-live error/status
  regions, a skip-to-content link, aria-current navigation, associated form labels.
• Flat surfaces (borders instead of shadows) per the design language.
• README rewritten — English-only, ISO 15189 wording tightened to "-oriented", a
  Scope & limitations disclaimer, live CI/release badges, Docker-first quick start.
• Docs de-staled — correct Docker ports, current versions, complete env-var tables,
  fixed dead links; new docs/README.md index. Fresh 1.0 screenshots.

Fixed

• Concurrency (critical): serialize the shared SQLite connection with a recursive
  mutex + busy_timeout — concurrent request threads could otherwise collide on
  transactions and corrupt the audit hash chain.
• RBAC: sample → VALIDATED release now requires ADMIN (matching order/result); the
  JWT effective role is derived from the live DB user, so role changes apply immediately.
• Audit trail: HL7/FHIR exports now log PHI disclosure; logAudit fails closed
  instead of writing a chain-breaking row on HMAC failure.
• Data integrity: CSV result import no longer mis-splits quoted fields or coerces
  malformed reference bounds to 0.0; NaN/inf values are no longer flagged NORMAL; the
  result-edit modal recomputes the flag when the value/range changes.
• Frontend: user roles normalized (fixes blank badges + an edit-dropdown privilege
  hazard); LOGIN_FAILED shown in the audit log; global search routes orders/results
  correctly; a stale token no longer blocks login; list-refetch races guarded; fixed the
  Tailwind-v4 modal-backdrop regression.

Security

• Externalize Docker Compose secrets to an untracked .env; fix the Dockerfile
  healthcheck; untrack the .vite build cache and debug HTML.

Assets

• OpenSylab-linux-x86_64 — prebuilt backend binary (Linux x86-64, dynamically linked; needs OpenSSL 3.x + SQLite3 at runtime).
• sbom-frontend.cdx.json — CycloneDX SBOM of the frontend npm dependencies (383 components).
• sbom-repo.cdx.json — CycloneDX SBOM of the repository / backend dependencies (via Trivy).
• SHA256SUMS — checksums; verify with sha256sum -c SHA256SUMS.

Docker: git clone … && cp .env.example .env && docker compose up -d → http://localhost:9090 (admin/admin, change immediately).
See the CHANGELOG and docs.