v2.17.0 — Sign in with Google, the app wears its mark

New

• Sign in with Google (AUTH-GOOGLE-01): OIDC authorization-code flow, ID token verified server-side through Google’s official library (JWKS, aud, iss, exp). Identity rules: verified email only; no self-provisioning — an unknown email gets a named refusal (GOOGLE_ACCOUNT_NOT_FOUND), never a silent account; googleId binds and takes precedence without rewriting the stored email; password login survives linking. A Google session honors the same PDA resume guards as a password session. The login’s admin@ placeholder is gone — fields read Email / Password.
• The app wears its mark (UI-NITS-01): the browser tab now shows the DockingWare mark — the approved small-size variant, byte-identical to the landing’s. SVG primary, ICO fallback.

Fixed

• Every report through the shared shell (inventory + accounting) gets the standard vertical rhythm — filter bar and table hosts were inline, swallowing the page’s space-y gap.

Migration

• One, additive (20260901180000_auth_google_01_google_id): googleId unique on User, password nullable (both password paths null-guarded). Zero DROP/RENAME — code rollback to v2.16.0 is safe.