Fix deploy loopback verification to accept login redirect

Reviewed-on: #13

.gitea/workflows/deploy-prod.yml

@@ -2,193 +2,210 @@ name: Deploy to Production
 
 on:
   push:
-    branches: [ main ]
+    branches:
+      - main
   workflow_dispatch:
 
+concurrency:
+  group: deploy-prod-main
+  cancel-in-progress: true
+
 env:
-  DEPLOY_HOST: 172.17.0.1
+  DEPLOY_HOST: 178.104.200.7
   DEPLOY_USER: kjh2064
-  DEPLOY_PATH: /home/kjh2064/quantengine_active
   SERVICE_NAME: quantengine
   DOTNET_VERSION: '10.0.x'
-  TELEGRAM_BOT_TOKEN_DEFAULT: "8734507814:AAFyacLMai8GB4K-hQ_Nd3t3D01A-h1ZdV0"
+  QUANTENGINE_DB_NAME: quantenginedb
+  QUANTENGINE_DB_USER: quantengine_app
+  TELEGRAM_BOT_TOKEN_DEFAULT: "8734507814:AAFyacLMai8GB4K-hQ_Nd3t3D01A-H1ZdV0"
   TELEGRAM_CHAT_ID_DEFAULT: "-5460205872"
 
 jobs:
   build-and-deploy:
     name: Build & Deploy to Production
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
-    - name: Checkout Code
-      uses: actions/checkout@v3
-      with:
-        fetch-depth: 0
+      - name: Checkout Code
+        uses: actions/checkout@v3
 
-    - name: Setup .NET
-      uses: actions/setup-dotnet@v3
-      with:
-        dotnet-version: ${{ env.DOTNET_VERSION }}
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v3
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
 
-    - name: Setup Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '3.10'
+      - name: Setup Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.10'
 
-    - name: Install Python Dependencies
-      run: pip install pyyaml openpyxl requests
+      - name: Install Python Dependencies
+        run: pip install pyyaml openpyxl requests
 
-    - name: "[GATE] Run Core Validations"
-      run: |
-        echo "🔐 Running critical CI validations..."
-        python3 tools/validate_no_direct_api_trading_v1.py || exit 1
-        python3 tools/validate_specs.py || exit 1
-        echo "✅ All critical validations passed"
+      - name: "[GATE] Run Core Validations"
+        run: |
+          echo "🔐 Running critical CI validations..."
+          python3 tools/validate_no_direct_api_trading_v1.py || exit 1
+          python3 tools/validate_specs.py || exit 1
+          echo "✅ All critical validations passed"
 
-    - name: Ensure Temp Directory and Mock Packet
-      run: |
-        mkdir -p Temp
-        # 빈 패킷 객체를 생성하여 dotnet test/run 시 IO Exception 방어
-        if [ ! -f Temp/final_decision_packet_active.json ]; then
-          echo '{"active_decision": "PASS", "details": "CI dummy packet"}' > Temp/final_decision_packet_active.json
-        fi
+      - name: Ensure Temp Directory and Mock Packet
+        run: |
+          mkdir -p Temp
+          if [ ! -f Temp/final_decision_packet_active.json ]; then
+            echo '{"active_decision": "PASS", "details": "CI dummy packet"}' > Temp/final_decision_packet_active.json
+          fi
 
-    - name: Restore Dependencies
-      run: dotnet restore src/dotnet/QuantEngine.Web/QuantEngine.Web.csproj
+      - name: Restore Dependencies
+        run: dotnet restore src/dotnet/QuantEngine.Web/QuantEngine.Web.csproj
 
-    - name: Build Release
-      run: |
-        dotnet build src/dotnet/QuantEngine.Web/QuantEngine.Web.csproj \
-          -c Release \
-          --no-restore \
-          -p:Version=1.0.${{ github.run_number }}
+      - name: Build Release
+        run: |
+          dotnet build src/dotnet/QuantEngine.Web/QuantEngine.Web.csproj \
+            -c Release \
+            --no-restore
 
-    - name: Run Unit Tests
-      run: |
-        if [ -d tests/unit ]; then
-          dotnet test tests/unit \
+      - name: Run Unit Tests
+        run: |
+          dotnet test src/dotnet/QuantEngine.Core.Tests/QuantEngine.Core.Tests.csproj \
+            -c Release \
+            --no-build
+
+      - name: Publish Release Package
+        run: |
+          dotnet publish src/dotnet/QuantEngine.Web/QuantEngine.Web.csproj \
             -c Release \
             --no-build \
-            || echo "⚠️ Some tests failed (non-blocking for web service)"
-        fi
+            -o ./publish
 
-    - name: Publish Release Package
-      run: |
-        dotnet publish src/dotnet/QuantEngine.Web/QuantEngine.Web.csproj \
-          -c Release \
-          --no-build \
-          -o ./publish-output
+      - name: Generate Build Info
+        run: |
+          COMMIT_HASH=$(git rev-parse --short HEAD)
+          BUILD_TIME=$(date -d "+9 hours" +'%Y-%m-%d %H:%M:%S KST')
+          mkdir -p ./publish/wwwroot
+          printf '{\n  "version": "1.0.%s-%s",\n  "built": "%s"\n}\n' "${{ github.run_number }}" "$COMMIT_HASH" "$BUILD_TIME" > ./publish/wwwroot/version.json
+          echo "✓ Generated version info: 1.0.${{ github.run_number }}-$COMMIT_HASH @ $BUILD_TIME"
 
-    - name: Generate Build Info
-      run: |
-        COMMIT_HASH=$(git rev-parse --short HEAD)
-        BUILD_TIME=$(date -d "+9 hours" +'%Y-%m-%d %H:%M:%S KST')
-        mkdir -p ./publish-output/wwwroot
-        printf '{\n  "version": "1.0.%s-%s",\n  "built": "%s"\n}\n' "${{ github.run_number }}" "$COMMIT_HASH" "$BUILD_TIME" > ./publish-output/wwwroot/version.json
-        echo "✓ Generated version info: 1.0.${{ github.run_number }}-$COMMIT_HASH @ $BUILD_TIME"
+      - name: Setup SSH
+        run: |
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          if echo "${{ secrets.SSH_PRIVATE_KEY }}" | grep -q "BEGIN"; then
+            echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
+          else
+            echo "${{ secrets.SSH_PRIVATE_KEY }}" | base64 -d > ~/.ssh/id_ed25519 || echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
+          fi
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keyscan -H ${{ env.DEPLOY_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
 
+      - name: Prepare QuantEngine DB Env
+        run: |
+          mkdir -p ./deploy
+          cat > ./deploy/quantengine.env <<EOF
+          ConnectionStrings__DefaultConnection=Host=127.0.0.1;Database=${QUANTENGINE_DB_NAME};Username=${QUANTENGINE_DB_USER};Password=${{ secrets.QUANTENGINE_DB_PASSWORD }};Search Path=quantengine;
+          EOF
+          chmod 600 ./deploy/quantengine.env
 
-    - name: Setup SSH
-      run: |
-        mkdir -p ~/.ssh
-        chmod 700 ~/.ssh
-        # SSH_PRIVATE_KEY가 평문 PEM이든 base64든 유연하게 처리
-        if echo "${{ secrets.SSH_PRIVATE_KEY }}" | grep -q "BEGIN"; then
-          echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
-        else
-          echo "${{ secrets.SSH_PRIVATE_KEY }}" | base64 -d > ~/.ssh/id_ed25519 || echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
-        fi
-        chmod 600 ~/.ssh/id_ed25519
-        ssh-keyscan -H ${{ env.DEPLOY_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
+      - name: Package Artifact
+        run: |
+          tar -czf quantengine.tar.gz -C ./publish .
+          echo "✓ Package size: $(du -sh quantengine.tar.gz | cut -f1)"
 
-    - name: Package Artifact
-      run: |
-        tar -czf quant_engine_deploy.tgz -C ./publish-output .
-        echo "✓ Package size: $(du -sh quant_engine_deploy.tgz | cut -f1)"
+      - name: Deploy & Verify on Server
+        run: |
+          set -e
+          TIMESTAMP=$(date +%Y%m%d_%H%M%S)
+          COMMIT=$(git rev-parse --short HEAD)
+          DEPLOY_HOST="${{ env.DEPLOY_HOST }}"
+          DEPLOY_USER="${{ env.DEPLOY_USER }}"
 
-    - name: Deploy & Verify on Server
-      run: |
-        set -e
-        TIMESTAMP=$(date +%Y%m%d_%H%M%S)
-        COMMIT=$(git rev-parse --short HEAD)
-        DEPLOY_HOST="${{ env.DEPLOY_HOST }}"
-        DEPLOY_USER="${{ env.DEPLOY_USER }}"
+          TELEGRAM_BOT_TOKEN="${{ secrets.TELEGRAM_BOT_TOKEN }}"
+          [ -z "$TELEGRAM_BOT_TOKEN" ] && TELEGRAM_BOT_TOKEN="${{ env.TELEGRAM_BOT_TOKEN_DEFAULT }}"
+          TELEGRAM_CHAT_ID="${{ secrets.TELEGRAM_CHAT_ID }}"
+          [ -z "$TELEGRAM_CHAT_ID" ] && TELEGRAM_CHAT_ID="${{ env.TELEGRAM_CHAT_ID_DEFAULT }}"
 
-        # 텔레그램 설정 바인딩 (Secret에 없을 경우 기본값 백업 사용)
-        TELEGRAM_BOT_TOKEN="${{ secrets.TELEGRAM_BOT_TOKEN }}"
-        [ -z "$TELEGRAM_BOT_TOKEN" ] && TELEGRAM_BOT_TOKEN="${{ env.TELEGRAM_BOT_TOKEN_DEFAULT }}"
-        TELEGRAM_CHAT_ID="${{ secrets.TELEGRAM_CHAT_ID }}"
-        [ -z "$TELEGRAM_CHAT_ID" ] && TELEGRAM_CHAT_ID="${{ env.TELEGRAM_CHAT_ID_DEFAULT }}"
+          send_telegram() {
+            local text="$1"
+            curl -fsS -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
+              -d "chat_id=${TELEGRAM_CHAT_ID}" \
+              --data-urlencode "text=${text}" \
+              -d "parse_mode=HTML" >/dev/null || true
+          }
 
-        send_telegram() {
-          local text="$1"
-          curl -fsS -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
-            -d "chat_id=${TELEGRAM_CHAT_ID}" \
-            --data-urlencode "text=${text}" \
-            -d "parse_mode=HTML" >/dev/null || true
-        }
+          notify_failure() {
+            local exit_code=$?
+            send_telegram "❌ <b>QuantEngine 배포 실패</b>
 
-        notify_failure() {
-          local exit_code=$?
-          send_telegram "❌ <b>QuantEngine 배포 실패</b>
+            커밋: <code>${COMMIT}</code>
+            시간: <code>${TIMESTAMP}</code>
+            단계: deploy-to-prod (SSH Execution)"
+            exit "$exit_code"
+          }
+
+          trap notify_failure ERR
+
+          echo "=== Deploying QuantEngine $COMMIT ($TIMESTAMP) ==="
+
+          ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ~/.ssh/id_ed25519 \
+            "$DEPLOY_USER@$DEPLOY_HOST" "mkdir -p /home/kjh2064/tmp"
+          scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ~/.ssh/id_ed25519 \
+            quantengine.tar.gz "$DEPLOY_USER@$DEPLOY_HOST:/home/kjh2064/tmp/quantengine.tar.gz"
+          scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ~/.ssh/id_ed25519 \
+            tools/deploy_quantengine.sh "$DEPLOY_USER@$DEPLOY_HOST:/home/kjh2064/tmp/deploy.sh"
+          scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ~/.ssh/id_ed25519 \
+            deploy/quantengine.env "$DEPLOY_USER@$DEPLOY_HOST:/home/kjh2064/tmp/quantengine.env"
+
+          ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ~/.ssh/id_ed25519 \
+            "$DEPLOY_USER@$DEPLOY_HOST" "chmod +x /home/kjh2064/tmp/deploy.sh && CI_DEPLOY=1 /home/kjh2064/tmp/deploy.sh"
+
+          ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ~/.ssh/id_ed25519 \
+            "$DEPLOY_USER@$DEPLOY_HOST" "mkdir -p /home/kjh2064/.config && install -m 600 /home/kjh2064/tmp/quantengine.env /home/kjh2064/.config/quantengine.env && rm -f /home/kjh2064/tmp/quantengine.env"
+
+          echo "=== Verifying Loopback Health ==="
+          loopback_headers=$(ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ~/.ssh/id_ed25519 "$DEPLOY_USER@$DEPLOY_HOST" "curl -s -D - -o /dev/null http://127.0.0.1:5000/")
+          echo "$loopback_headers"
+          if ! printf '%s' "$loopback_headers" | grep -qE '^HTTP/1\.[01] 30[12] '; then
+            echo "Loopback health check failed for quantengine" >&2
+            exit 1
+          fi
+          if ! printf '%s' "$loopback_headers" | grep -qiE '^Location: /login'; then
+            echo "Loopback redirect target is unexpected" >&2
+            exit 1
+          fi
+
+          echo "=== Verifying Favicon Assets ==="
+          favicon_svg_code=$(curl -s -o /dev/null -w "%{http_code}" "http://${DEPLOY_HOST}/favicon.svg")
+          favicon_png_code=$(curl -s -o /dev/null -w "%{http_code}" "http://${DEPLOY_HOST}/favicon.png")
+          echo "/favicon.svg -> ${favicon_svg_code}"
+          echo "/favicon.png -> ${favicon_png_code}"
+          if [ "$favicon_svg_code" != "200" ] && [ "$favicon_png_code" != "200" ]; then
+            echo "Favicon assets are not reachable after deploy" >&2
+            exit 1
+          fi
+
+          echo "=== Verifying Public Routes ==="
+          public_root_headers=$(curl -s -D - -o /dev/null "https://quant.taxbaik.com/")
+          login_headers=$(curl -s -D - -o /dev/null "https://quant.taxbaik.com/login")
+
+          public_root_code=$(printf '%s' "$public_root_headers" | awk 'NR==1 {print $2}')
+          login_code=$(printf '%s' "$login_headers" | awk 'NR==1 {print $2}')
+
+          echo "https://quant.taxbaik.com/ -> ${public_root_code}"
+          echo "https://quant.taxbaik.com/login -> ${login_code}"
+
+          if [ "$public_root_code" != "302" ] && [ "$public_root_code" != "200" ]; then
+            echo "Deployment content check failed for public root" >&2
+            exit 1
+          fi
+          if [ "$login_code" != "200" ]; then
+            echo "Deployment content check failed for login page" >&2
+            exit 1
+          fi
+
+          echo "✓ 배포 완료: quantengine_${TIMESTAMP} @ $DEPLOY_HOST"
+          send_telegram "✅ <b>QuantEngine 배포 완료</b>
 
           커밋: <code>${COMMIT}</code>
           시간: <code>${TIMESTAMP}</code>
-          단계: deploy-to-prod (SSH Execution)"
-          exit "$exit_code"
-        }
-
-        trap notify_failure ERR
-
-        echo "=== Deploying QuantEngine $COMMIT ($TIMESTAMP) ==="
-
-        # 1. 아티팩트 복사
-        scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ~/.ssh/id_ed25519 \
-          quant_engine_deploy.tgz "$DEPLOY_USER@$DEPLOY_HOST:/tmp/quantengine_${TIMESTAMP}.tgz"
-
-        # 2. 원격 배포 명령어 통합 (SSH 1회 연결)
-        ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ~/.ssh/id_ed25519 \
-          -o ServerAliveInterval=10 \
-          "$DEPLOY_USER@$DEPLOY_HOST" bash << REMOTE
-        set -e
-        DEPLOY_HOME="/home/kjh2064"
-        DEPLOY_DIR="\$DEPLOY_HOME/deployments/quantengine_${TIMESTAMP}"
-        
-        echo "--- [1/4] 압축 해제 ---"
-        mkdir -p "\$DEPLOY_DIR"
-        tar -xzf "/tmp/quantengine_${TIMESTAMP}.tgz" -C "\$DEPLOY_DIR"
-        rm -f "/tmp/quantengine_${TIMESTAMP}.tgz"
-
-        echo "--- [2/4] 심볼릭 링크 전환 ---"
-        ln -sfn "\$DEPLOY_DIR" "${{ env.DEPLOY_PATH }}"
-
-        echo "--- [3/4] 서비스 재시작 ---"
-        sudo /usr/bin/systemctl restart ${{ env.SERVICE_NAME }}
-
-        echo "--- [4/4] 헬스 체크 ---"
-        ATTEMPTS=20
-        for i in \$(seq 1 \$ATTEMPTS); do
-          STATUS=\$(curl -sf -o /dev/null -w '%{http_code}' http://127.0.0.1:5000/ 2>/dev/null || echo "000")
-          if [ "\$STATUS" = "200" ]; then
-            echo "✓ 헬스체크 성공 (시도 \$i/\$ATTEMPTS, HTTP 200)"
-            # 구 배포 폴더 정리 (최근 5개만 보존)
-            ls -1dt \$DEPLOY_HOME/deployments/quantengine_* 2>/dev/null | tail -n +6 | xargs rm -rf 2>/dev/null || true
-            exit 0
-          fi
-          if [ "\$i" -eq "\$ATTEMPTS" ]; then
-            echo "=== FATAL: 서비스가 헬스체크 응답을 하지 않음 ===" >&2
-            systemctl is-active ${{ env.SERVICE_NAME }} >&2 || true
-            journalctl -u ${{ env.SERVICE_NAME }} --no-pager -n 50 >&2
-            exit 1
-          fi
-          echo "  대기 중... (\$i/\$ATTEMPTS, HTTP \$STATUS)"
-          sleep 3
-        done
-        REMOTE
-
-        echo "✓ 배포 완료: quantengine_${TIMESTAMP} @ $DEPLOY_HOST"
-        send_telegram "✅ <b>QuantEngine 배포 완료</b>
-        
-        커밋: <code>${COMMIT}</code>
-        시간: <code>${TIMESTAMP}</code>
-        대상: <code>${DEPLOY_HOST}</code>"
+          대상: <code>${DEPLOY_HOST}</code>"

.gitea/workflows/snapshot_admin_deploy.yml

@@ -1,131 +0,0 @@
-name: Snapshot Admin Deployment
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-concurrency:
-  group: snapshot-admin-deploy-main
-  cancel-in-progress: true
-
-env:
-  DEPLOY_HOST: 178.104.200.7
-  DEPLOY_USER: kjh2064
-  TELEGRAM_BOT_TOKEN_DEFAULT: "8734507814:AAFyacLMai8GB4K-hQ_Nd3t3D01A-h1ZdV0"
-  TELEGRAM_CHAT_ID_DEFAULT: "-5460205872"
-
-jobs:
-  build-and-deploy:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - name: Checkout Code
-        uses: actions/checkout@v3
-
-      - name: Setup .NET SDK
-        uses: actions/setup-dotnet@v3
-        with:
-          dotnet-version: '10.0.x'
-
-      - name: Publish Blazor Web App
-        run: |
-          echo "[deploy] publishing .NET 10 Blazor app"
-          dotnet publish src/dotnet/QuantEngine.Web/QuantEngine.Web.csproj -c Release -o ./publish
-
-      - name: Generate Build Info
-        run: |
-          COMMIT_HASH=$(git rev-parse --short HEAD)
-          BUILD_TIME=$(date -d "+9 hours" +'%Y-%m-%d %H:%M:%S KST')
-          mkdir -p ./publish/wwwroot
-          printf '{\n  "version": "1.0.%s-%s",\n  "built": "%s"\n}\n' "${{ github.run_number }}" "$COMMIT_HASH" "$BUILD_TIME" > ./publish/wwwroot/version.json
-          echo "✓ Generated version info: 1.0.${{ github.run_number }}-$COMMIT_HASH @ $BUILD_TIME"
-
-
-      - name: Compress Artifact
-        run: |
-          echo "[deploy] compressing publish output"
-          tar -czf quantengine.tar.gz -C ./publish .
-
-      - name: Setup SSH
-        run: |
-          mkdir -p ~/.ssh
-          chmod 700 ~/.ssh
-          if echo "${{ secrets.SSH_PRIVATE_KEY }}" | grep -q "BEGIN"; then
-            echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
-          else
-            echo "${{ secrets.SSH_PRIVATE_KEY }}" | base64 -d > ~/.ssh/id_ed25519 || echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
-          fi
-          chmod 600 ~/.ssh/id_ed25519
-          ssh-keyscan -H ${{ env.DEPLOY_HOST }} >> ~/.ssh/known_hosts 2>/dev/null || true
-
-      - name: Deploy & Verify on Server
-        run: |
-          set -e
-          TIMESTAMP=$(date +%Y%m%d_%H%M%S)
-          COMMIT=$(git rev-parse --short HEAD)
-          DEPLOY_HOST="${{ env.DEPLOY_HOST }}"
-          DEPLOY_USER="${{ env.DEPLOY_USER }}"
-
-          TELEGRAM_BOT_TOKEN="${{ secrets.TELEGRAM_BOT_TOKEN }}"
-          [ -z "$TELEGRAM_BOT_TOKEN" ] && TELEGRAM_BOT_TOKEN="${{ env.TELEGRAM_BOT_TOKEN_DEFAULT }}"
-          TELEGRAM_CHAT_ID="${{ secrets.TELEGRAM_CHAT_ID }}"
-          [ -z "$TELEGRAM_CHAT_ID" ] && TELEGRAM_CHAT_ID="${{ env.TELEGRAM_CHAT_ID_DEFAULT }}"
-
-          send_telegram() {
-            local text="$1"
-            curl -fsS -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
-              -d "chat_id=${TELEGRAM_CHAT_ID}" \
-              --data-urlencode "text=${text}" \
-              -d "parse_mode=HTML" >/dev/null || true
-          }
-
-          notify_failure() {
-            local exit_code=$?
-            send_telegram "❌ <b>Snapshot Admin 배포 실패</b>
-            
-            커밋: <code>${COMMIT}</code>
-            시간: <code>${TIMESTAMP}</code>
-            단계: snapshot_admin_deploy (Deploy Execution)"
-            exit "$exit_code"
-          }
-
-          trap notify_failure ERR
-
-          echo "=== Deploying Snapshot Admin $COMMIT ($TIMESTAMP) ==="
-
-          # 1. 원격지 임시 폴더 생성 및 업로드
-          ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ~/.ssh/id_ed25519 "$DEPLOY_USER@$DEPLOY_HOST" "mkdir -p /home/kjh2064/tmp"
-          scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ~/.ssh/id_ed25519 quantengine.tar.gz "$DEPLOY_USER@$DEPLOY_HOST:/home/kjh2064/tmp/quantengine.tar.gz"
-          scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ~/.ssh/id_ed25519 tools/deploy_quantengine.sh "$DEPLOY_USER@$DEPLOY_HOST:/home/kjh2064/tmp/deploy.sh"
-
-          # 2. 배포 스크립트 실행
-          ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i ~/.ssh/id_ed25519 "$DEPLOY_USER@$DEPLOY_HOST" "chmod +x /home/kjh2064/tmp/deploy.sh && /home/kjh2064/tmp/deploy.sh"
-
-          # 3. 배포 성공 검증
-          echo "=== Verifying Public Routes ==="
-          root_html=$(curl -sf "http://${DEPLOY_HOST}/quant/" 2>/dev/null || echo "")
-          ops_html=$(curl -sf "http://${DEPLOY_HOST}/quant/operations" 2>/dev/null || echo "")
-          
-          root_code=$(printf '%s' "$root_html" | grep -q "Quant Engine" && echo 200 || echo 500)
-          ops_code=$(printf '%s' "$ops_html" | grep -q "Operational Report" && echo 200 || echo 500)
-
-          echo "/quant/ -> ${root_code}"
-          echo "/quant/operations -> ${ops_code}"
-
-          if [ "$root_code" != "200" ]; then
-            echo "Deployment content check failed for /quant/" >&2
-            exit 1
-          fi
-          if [ "$ops_code" != "200" ]; then
-            echo "Deployment content check failed for /quant/operations" >&2
-            exit 1
-          fi
-
-          echo "✓ 배포 완료: quantengine_${TIMESTAMP} @ $DEPLOY_HOST"
-          send_telegram "✅ <b>Snapshot Admin 배포 완료</b>
-          
-          커밋: <code>${COMMIT}</code>
-          시간: <code>${TIMESTAMP}</code>
-          대상: <code>${DEPLOY_HOST}</code>"

AGENTS.md

@@ -110,6 +110,8 @@
 - D+2 영업일 기준 현금을 즉시방어 자산으로 간주하고, 목표 예산 5억 원을 기준으로 포지션 사이징 및 리스크 버킷을 제어한다.
 - 매주 주말 리밸런싱(rebalance_required=true) 및 매월 1일/11일/21일 중간점검(mid_check_required=true) 운영 cadence를 준수한다.
 - 커밋, 푸쉬, PR 작업 시 반드시 로컬의 .gs 파일을 Google Apps Script 원격 프로젝트에 업로드(python tools/deploy_gas.py 실행)하고, 사용자에게 스프레드시트 상의 스크립트 실행(예: runDataFeed)을 통한 검증을 유도 및 가이드해야 한다.
+- QuantEngine 배포는 CI 전용이다. 로컬에서 서버로 산출물을 직접 업로드하거나 `scp`/`rsync`로 수동 반영하지 않는다. 실배포는 `.gitea/workflows/deploy-prod.yml`만 사용하며, 로컬 스크립트는 CI 환경에서만 실행 가능해야 한다.
+- 원격 서버 확인이 필요하면 `ssh kjh2064@178.104.200.7` 접속을 먼저 시도하고, 사용자에게 매번 접속 확인을 요구하지 말고 직접 상태/로그/헬스체크를 수집한 뒤 결과만 보고한다.
 
 ## 4. 보고 규칙
 - 모든 숫자에는 반드시 provenance(출처)를 남기며, 출처가 유효하지 않거나 없는 숫자는 보고서 표기를 전면 배제(DATA_MISSING 처리)한다.
@@ -135,7 +137,8 @@
 - **임시 파일 관리**: 개발/디버깅 목적의 모든 휘발성 임시 파일 및 로그는 반드시 `Temp/` 디렉토리 하위에서만 생성해야 하며, 루트나 다른 패키지 경로에 임시 파일을 만드는 것은 금지한다. 불가피하게 생성할 경우 반드시 접두사/접미사 규칙(`debug_*`, `tmp_*`, `mock_*`, `*_temp.*`)을 준수하여 `.gitignore`에 필터링되도록 한다.
 
 ## 5b. Blazor & API-First 개발 규칙 (TaxBaik 참조 모델 적용)
-- **API-First 아키텍처**: Blazor Server UI 계층은 비즈니스 로직이나 DB에 직접 결합되지 않고, `IXxxBrowserClient` 등의 추상화된 API 클라이언트(HTTP/RESTful)를 통해서만 백엔드 API와 통신한다.
+- **렌더 모드 표준**: Blazor **Interactive WebAssembly** 를 기본 렌더 모드로 한다. InteractiveServer 는 사용하지 않으며, UI 컴포넌트는 **MudBlazor** 로 통일한다 (Fluent UI 는 폐기).
+- **API-First 아키텍처**: Blazor Interactive WebAssembly UI 계층은 비즈니스 로직이나 DB에 직접 결합되지 않고, `IXxxBrowserClient` 등의 추상화된 API 클라이언트(HTTP/RESTful)를 통해서만 백엔드 API와 통신한다.
 - **이중 토큰 인증 패턴**: Access Token(15분) 및 Refresh Token(7일) 이중 토큰 패턴을 적용하며, HttpClient 요청 시 401 Unauthorized를 가로채어 자동으로 localStorage의 Refresh Token으로 토큰을 자동 갱신 및 재시도하는 `TokenRefreshHandler` (DelegatingHandler) 구조를 준수한다.
 - **실시간 알림 (SignalR)**: 실시간 알림 기능은 상태를 직접 동기화하는 용도가 아닌 단순 Event-driven 브로드캐스트 알림으로 설계하며, 클라이언트는 알림 수신 후 API 호출을 통해 최종 데이터를 검증 및 동기화한다.
 - **UI/UX 구현**:

CLAUDE.md

@@ -7,18 +7,18 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 **QuantEngine v0.1** — A comprehensive quantitative analysis and data collection system for retirement asset portfolio management.
 
 - **Architecture**: .NET 9 + C# (web UI + APIs), Python (legacy data collection/analysis)
-- **Web UI**: Blazor WebAssembly (Fluent UI Blazor v5) + ASP.NET Core Web API
+- **Web UI**: Blazor Interactive WebAssembly (MudBlazor) + ASP.NET Core Web API (API-First)
 - **Database**: PostgreSQL (Npgsql 8.0), single unified database
 - **Data Source**: KIS Open API (quotations/ranking read-only), with fallbacks
 - **Key Runtimes**: .NET 9, Python 3.9+, Node.js 16+
 
 ### Migration Phases Status (2026-06-29)
 
-**Phase 1: Web UI Migration** ✅ COMPLETE
-- Blazor WebAssembly with Fluent UI v5 (RC: 5.0.0-rc.4-26177.1)
-- MudBlazor completely deprecated (0% remaining)
+**Phase 1: Web UI Migration** 🔄 정책 전환 (2026-06-30)
+- **신규 표준**: Blazor **Interactive WebAssembly** 렌더 모드 + **MudBlazor** 컴포넌트 + API-First
+- **이전 표준(폐기)**: Fluent UI Blazor v5 / InteractiveServer 렌더 모드는 더 이상 사용하지 않음
 - Pages: Home, Workspace, Collection, Tables, MainLayout
-- Build: 0 errors, 6 Razor RC warnings (acceptable)
+- 코드 전환 작업은 `docs/WBS_10_DOTNET_MIGRATION_HARDENING_2026_06_30.md` 의 **WBS-A7** 로 추적
 
 **Phase 2: KIS Data Collection Pipeline** ✅ 95% COMPLETE
 - ✅ KIS API Client: Full implementation complete
@@ -84,22 +84,24 @@ sudo systemctl restart quantengine-api
 
 ### Framework & Design System
 
-- **Primary Framework**: [Fluent UI Blazor v5](https://v5.fluentui-blazor.net/)
-- **Design System**: Microsoft Fluent Design System (WCAG 2.1 AA)
-- **Deprecation**: MudBlazor is deprecated. Migrate all existing pages to Fluent UI v5 progressively.
+- **Primary Framework**: [MudBlazor](https://mudblazor.com/)
+- **Design System**: Material Design (MudBlazor), 고밀도/대량 데이터 성능 우선
+- **Render Mode**: **Interactive WebAssembly** 를 기본 렌더 모드로 한다 (API-First). InteractiveServer 는 사용하지 않는다.
+- **Deprecation**: **Fluent UI Blazor v5 는 폐기**한다. 기존 Fluent UI 페이지는 MudBlazor 로 점진 이전한다.
 
 ### Component Development Rules
 
 1. **All UI Development** (New + Refactored):
-   - Use Fluent UI Blazor v5 components exclusively
-   - Fall back to pure HTML/CSS if Fluent v5 doesn't provide
-   - **Never introduce MudBlazor components** (deprecated)
-   - Progressively migrate existing MudBlazor to Fluent v5
+   - Use **MudBlazor** components exclusively
+   - Fall back to pure HTML/CSS if MudBlazor doesn't provide
+   - **Never introduce Fluent UI components** (deprecated)
+   - Progressively migrate existing Fluent UI to MudBlazor
+   - **API-First**: UI 는 DB/비즈니스 로직에 직접 결합하지 않고 추상화된 API 클라이언트(HTTP)로만 통신 (AGENTS.md §5b 준수)
 
 2. **Loading States** (Priority order):
-   - `<FluentSkeleton>` — **Default** for lists, cards, dashboards, detail pages
+   - `<MudSkeleton>` — **Default** for lists, cards, dashboards, detail pages
    - Pure HTML `<div class="skeleton">` — For custom layouts
-   - `MudProgressCircular` / `MudProgressLinear` — Exception only (existing legacy)
+   - `<MudProgressCircular>` / `<MudProgressLinear>` — 명시적 진행 표시가 필요한 경우
    - Blocking spinners — **Avoid**
 
 3. **Data Rendering Pattern**:
@@ -107,21 +109,22 @@ sudo systemctl restart quantengine-api
    - On data arrival: Replace skeleton with actual UI
    - Never show blank states while loading
 
-4. **Component Mapping** (Fluent UI v5):
+4. **Component Mapping** (MudBlazor):
 
-| UI Element | Fluent UI Component | Alternative |
+| UI Element | MudBlazor Component | Alternative |
 |-----------|-------------------|-------------|
-| Button | `<FluentButton>` | - |
-| Input field | `<FluentTextField>` | HTML `<input>` |
-| Dropdown | `<FluentSelect>` | HTML `<select>` |
-| Data grid | `<FluentDataGrid>` | HTML `<table>` |
-| Card | `<FluentCard>` | HTML `<div class="card">` |
-| Badge/Status | `<FluentBadge>` | HTML `<span>` |
-| Layout container | `<FluentStack>` | HTML `<div>` |
-| Accordion | `<FluentAccordion>` | HTML `<details>` |
-| Navigation | `<FluentNavMenu>` | HTML `<nav>` |
-| Loading | `<FluentSkeleton>` | CSS skeleton animation |
-| Icons | `<FluentIcon>` | SVG inline |
+| Button | `<MudButton>` | - |
+| Input field | `<MudTextField>` | HTML `<input>` |
+| Dropdown | `<MudSelect>` | HTML `<select>` |
+| Data grid | `<MudDataGrid Dense Virtualize>` | HTML `<table>` |
+| Card | `<MudCard>` | HTML `<div class="card">` |
+| Badge/Status | `<MudBadge>` / `<MudChip>` | HTML `<span>` |
+| Layout container | `<MudStack>` / `<MudGrid>` | HTML `<div>` |
+| Accordion | `<MudExpansionPanels>` | HTML `<details>` |
+| Navigation | `<MudNavMenu>` | HTML `<nav>` |
+| Loading | `<MudSkeleton>` | CSS skeleton animation |
+| Icons | `<MudIcon>` | SVG inline |
+| Modal/Dialog | `<MudDialog>` (CRUD: 모달 패턴, 삭제: ConfirmDialog) | - |
 
 ## Development Commands (Phase 1 + 2)
 

README.md

@@ -144,7 +144,7 @@ npm run prepare-upload-zip
 ## CI / 배포 분리
 
 - `.gitea/workflows/ci.yml`은 검증 전용이다.
-- `.gitea/workflows/snapshot_admin_deploy.yml`은 실배포 전용이다.
+- `.gitea/workflows/deploy-prod.yml`은 실배포 전용이다.
 - 공개 URL `http://178.104.200.7/quant/` 갱신은 deploy workflow 성공 여부로 판단한다.
 
 ## 운영 리포트 계약

docs/CLOUD_SERVER_SETUP.md

@@ -206,8 +206,9 @@ services:
 ### 6.4. CI / 배포 분리
 
 - `.gitea/workflows/ci.yml`: 검증 전용. 스펙/공식/리포트/아티팩트 생성까지만 수행한다.
-- `.gitea/workflows/snapshot_admin_deploy.yml`: 실배포 전용. `dotnet publish` 후 `tools/deploy_quantengine.sh`를 이용해 `/home/kjh2064/quantengine_active`로 반영한다.
-- 공개 URL `/quant/` 갱신은 `snapshot_admin_deploy.yml`의 성공 여부를 기준으로 판단한다.
+- `.gitea/workflows/deploy-prod.yml`: 실배포 전용. `dotnet publish` 후 `tools/deploy_quantengine.sh`를 이용해 `/home/kjh2064/quantengine_active`로 반영한다.
+- 수동 배포 금지: 로컬에서 `scp`/`rsync`로 `quantengine_active`를 갱신하지 않는다. 배포는 CI가 원격에서만 수행하고, 로컬 스크립트는 `CI_DEPLOY=1` 없이 실행되면 실패해야 한다.
+- 공개 URL 갱신은 `deploy-prod.yml`의 성공 여부를 기준으로 판단한다.
 
 ### 6.2. 러너 설정
 
@@ -401,19 +402,9 @@ docker ps -a
 ### QuantEngine 배포
 
 ```bash
-# 1. 새 배포 디렉토리 생성
-DEPLOY_DIR=~/deployments/quantengine_$(date +%Y%m%d_%H%M%S)
-mkdir -p "$DEPLOY_DIR"
-
-# 2. 빌드 산출물 복사 (로컬에서 scp 또는 CI에서)
-scp -r publish/* kjh2064@178.104.200.7:"$DEPLOY_DIR"/
-
-# 3. symlink 교체
-ln -sfn "$DEPLOY_DIR" ~/quantengine_active
-
-# 4. 서비스 재시작
-sudo systemctl restart quantengine
-sudo systemctl status quantengine
+# CI에서만 배포
+# 로컬에서 scp/rsync로 quantengine_active를 갱신하지 않는다.
+# 배포는 .gitea/workflows/deploy-prod.yml 실행 결과로만 반영한다.
 ```
 
 ### Gitea Act Runner 등록

docs/POSTGRESQL_SECURITY_GUIDE.md

@@ -9,7 +9,7 @@ This document outlines the security configuration, role definitions, and access
 The Quant Investment Engine operates strictly within the `quantengine` schema to prevent namespace pollution and protect system catalog tables.
 
 * **Schema**: `quantengine`
-* **Default Database**: `giteadb`
+* **Default Database**: `quantenginedb`
 
 ---
 
@@ -22,7 +22,7 @@ To ensure the principle of least privilege, we define three main database roles:
 * **Permissions**:
   ```sql
   CREATE ROLE quantengine_owner WITH LOGIN PASSWORD 'OwnerPasswordSecure';
-  GRANT ALL PRIVILEGES ON DATABASE giteadb TO quantengine_owner;
+  GRANT ALL PRIVILEGES ON DATABASE quantenginedb TO quantengine_owner;
   GRANT ALL PRIVILEGES ON SCHEMA quantengine TO quantengine_owner;
   ALTER DEFAULT PRIVILEGES IN SCHEMA quantengine GRANT ALL ON TABLES TO quantengine_owner;
   ```
@@ -32,7 +32,7 @@ To ensure the principle of least privilege, we define three main database roles:
 * **Permissions**:
   ```sql
   CREATE ROLE quantengine_app WITH LOGIN PASSWORD 'AppPasswordSecure';
-  GRANT CONNECT ON DATABASE giteadb TO quantengine_app;
+  GRANT CONNECT ON DATABASE quantenginedb TO quantengine_app;
   GRANT USAGE ON SCHEMA quantengine TO quantengine_app;
   
   -- Grant CRUD permissions on tables & sequences
@@ -48,7 +48,7 @@ To ensure the principle of least privilege, we define three main database roles:
 * **Permissions**:
   ```sql
   CREATE ROLE quantengine_readonly WITH LOGIN PASSWORD 'ReadonlyPasswordSecure';
-  GRANT CONNECT ON DATABASE giteadb TO quantengine_readonly;
+  GRANT CONNECT ON DATABASE quantenginedb TO quantengine_readonly;
   GRANT USAGE ON SCHEMA quantengine TO quantengine_readonly;
   
   GRANT SELECT ON ALL TABLES IN SCHEMA quantengine TO quantengine_readonly;
@@ -63,7 +63,7 @@ To ensure the principle of least privilege, we define three main database roles:
    * Never store connection strings with plaintext passwords in version control.
    * `appsettings.json` must only contain placeholder configurations.
    * Inject the connection string at runtime using environment variables:
-     `ConnectionStrings__DefaultConnection="Host=127.0.0.1;Database=giteadb;Username=quantengine_app;Password=YourSecurePassword;Search Path=quantengine;"`
+     `ConnectionStrings__DefaultConnection="Host=127.0.0.1;Database=quantenginedb;Username=quantengine_app;Password=YourSecurePassword;Search Path=quantengine;"`
 
 2. **Network Security**:
    * Bind PostgreSQL only to local interfaces (`127.0.0.1`) or secure private network interfaces.

docs/ROADMAP_WBS.md

@@ -925,7 +925,7 @@ python tools/validate_specs.py → PASS
 |------|------|
 | **작업** | `src/quant_engine/snapshot_admin_server_v1.py`(Python 어드민 웹 UI)를 Gitea CI/CD 배포 스텝을 통해 Synology NAS에서 상시 서비스로 운영할 수 있는지 검토 |
 | **현재 상태** | **기술적으로는 가능**. 기본 루프백 보호 + Basic Auth 게이트를 추가했고, Synology 외부 노출은 리버스 프록시 기반 POC로 가이드함. 실배포 검증은 아직 필요 |
-| **운영 분리** | `snapshot_admin.yml`은 `push`용 smoke 검증과 `workflow_dispatch`용 full 검증으로 분리하고, 배포는 별도 `snapshot_admin_deploy.yml` `workflow_dispatch`로 떼어냈다. `push`에서는 `Validate Snapshot Admin Workflow`까지만, full 검증에서는 `Validate Snapshot Admin Web UI`까지 수행한다. |
+| **운영 분리** | `snapshot_admin.yml`은 `push`용 smoke 검증과 `workflow_dispatch`용 full 검증으로 분리하고, 배포는 별도 `deploy-prod.yml` `workflow_dispatch`로 떼어냈다. `push`에서는 `Validate Snapshot Admin Workflow`까지만, full 검증에서는 `Validate Snapshot Admin Web UI`까지 수행한다. |
 | **runner 주의** | Gitea runner를 Docker mode로 두면 job 종료 시 `Cleaning up container` 로그가 남는다. host label로 재등록하면 job container 정리 로그를 피할 수 있다. |
 | **KIS 분리** | `kis_data_collection.yml`은 `workflow_dispatch`용 mock/config smoke와 `schedule`용 live collection으로 분리했다. 수동 디스패치는 실제 수집을 돌리지 않고, 실수집은 스케줄 전용이다. |
 | **담당 파일** | `.gitea/workflows/ci.yml`, `tools/run_snapshot_admin_server_v1.py`, `src/quant_engine/snapshot_admin_server_v1.py`, `docs/SYNOLOGY_SNAPSHOT_ADMIN_POC.md`, `docs/WBS_7_9_EVIDENCE_PACKET_FINAL.md` |
@@ -1378,6 +1378,8 @@ WBS-8.8 (KIS 리팩터) — 독립적 (원격 병행)
 
 ### WBS-10: C#/.NET 엔진 고도화 (Phase 10, 2026-06~12)
 
+> **📌 보강 문서(2026-06-30):** 본 WBS-10 의 다수 항목이 `완료` 표기되어 있으나 실측 결과 일부 괴리(10.6 파이프라인·10.9 보안 실질 미완성)가 확인되었다. 마이그레이션 완성 우선 + 상용화 잔여 작업의 재정의는 [WBS_10_DOTNET_MIGRATION_HARDENING_2026_06_30.md](./WBS_10_DOTNET_MIGRATION_HARDENING_2026_06_30.md) 참조.
+
 > 현황 진단(2026-06-26): .NET 프로젝트는 Python 엔진(41 모듈, 14,500 LOC) 대비 5~10%(~1,400 LOC) 수준.
 > Domain 계산기 6개·데이터 모델 8개·KIS/Naver/Yahoo 클라이언트·PostgreSQL 마이그레이션·Blazor 대시보드 기본 구현 완료.
 > **미구현**: Application 서비스 일부, 공식 엔진, 하네스 주입, 파이프라인 오케스트레이터.
@@ -1649,7 +1651,7 @@ WBS-10.1 (기반 결함 수정)
 | 10.10.2 | Dashboard 상태 페이지 — 데이터 비의존형 요약으로 단순화 | DB 실패 시에도 200 응답 (완료) |
 | 10.10.3 | Counter.razor / Weather.razor 기본 페이지 삭제, NavMenu 정비 | 불필요 페이지 0건, NavMenu에 Dashboard/Operations만 표시 (완료) |
 | 10.10.4 | 다크 모드 + 반응형 레이아웃 적용 | 브라우저 렌더링 정상 확인 (완료) |
-| 10.10.5 | 배포 동기화 | `snapshot_admin_deploy.yml`가 `/quant/`와 `/quant/operations` 공개 라우트를 배포 후 검증하도록 구성됨 (완료) |
+| 10.10.5 | 배포 동기화 | `deploy-prod.yml`가 공개 라우트를 배포 후 검증하도록 구성됨 (완료) |
 
 **성공 하네스 (데이터 기준)**:
 ```

docs/WBS_10_DOTNET_MIGRATION_HARDENING_2026_06_30.md

@@ -0,0 +1,190 @@
+# WBS-10 보강: .NET Core 마이그레이션 완성 & 상용화 로드맵 (2026-06-30)
+
+> 본 문서는 [docs/ROADMAP_WBS.md](./ROADMAP_WBS.md) 의 **WBS-10(.NET 엔진 고도화)** 을 현 시점 실측 기준으로 재진단하고, 마이그레이션 완성과 단일 사용자 상용 운영에 필요한 잔여 작업을 재정의한다.
+>
+> **작성 배경:** 기존 WBS-10 의 다수 항목이 `완료` 로 표기되어 있으나, 2026-06-30 소스 실측 결과 **표기와 실제 상태 간 괴리**가 확인되었다. 본 문서는 그 괴리를 정리하고 실제 잔여 작업을 추적한다.
+>
+> **의사결정(사용자 확정):** ① 우선순위 = **마이그레이션 완성 우선**, ② 산출물 = **로드맵/WBS 문서**, ③ 인증 모델 = **단일 사용자 + 기본 보호**.
+
+---
+
+## 1. Context — 왜 이 보강이 필요한가
+
+QuantEngine 은 은퇴자산 포트폴리오 운용을 위한 결정론적 퀀트 엔진이다. canonical 권위는 여전히 **Python 구현(219 파일, 24,683 lines)** 에 있고, `.NET 10` 마이그레이션은 Core / Application / Infrastructure / Web / Tools / Tests 6개 프로젝트로 구조화되어 Phase 1(Web UI)·Phase 2(KIS 수집)까지 도달했다.
+
+그러나 다음 세 가지 근본 결손으로 마이그레이션 완료 및 상용 기준에 미달한다.
+
+1. **마이그레이션 미완성** — 도메인 단일 권위가 Python 에 잔존. `PipelineOrchestrator` 가 실제 로직이 아닌 시뮬레이션 스텁. Python↔.NET 패리티가 일부 도메인 계산기에만 존재. GAS 공식 14건 미이관.
+2. **상용 운영 결손** — 소스에 하드코딩 시크릿 잔존, `.gitignore` 의 `bin/obj` 누락으로 빌드 산출물 git 추적, 헬스체크·메트릭·재시도·스케줄러·운영 구성(`appsettings.Production.json`) 부재.
+3. **검증 공백** — KIS→스냅샷→정성매도 전 구간 E2E 와 CI 커버리지 게이트 부재.
+
+---
+
+## 2. 표기 vs 실제 괴리 정리 (2026-06-30 실측)
+
+| 기존 WBS | 기존 표기 | 실측 상태 | 괴리 / 조치 |
+|---|---|---|---|
+| WBS-10.6 파이프라인 오케스트레이터 | **완료** | `PipelineOrchestrator.cs` 가 각 단계를 `Task.Delay(10)` 로만 시뮬레이션. 실제 서비스 호출 없음 | 🔴 **실질 미완성.** → 본 문서 **A1** 로 재추적 |
+| WBS-10.9 보안 강화 | **완료** | `appsettings.json` 은 `Password=;` 처리됨. 그러나 `Program.cs:19` 텔레그램 토큰 평문, `Program.cs:34` DB 패스워드 폴백 평문 잔존. `.gitignore` 에 `bin/obj` 없음 → 산출물 git 추적 | 🔴 **부분 완료(핵심 누락).** → 본 문서 **P0** 로 재추적 |
+| WBS-10.8 데이터 수집 오케스트레이터 | **TODO** | 실제로는 `DataCollectionService.cs`(KIS 수집 오케스트레이션) 구현·커밋됨. 단 파일명/구조가 WBS 기재(`DataCollectionOrchestrator.cs`)와 불일치 | 🟡 **표기 미갱신.** → 본 문서 **A3** 로 정합화 |
+| WBS-10.3~10.5 도메인/공식/하네스 패리티 | 완료 | `DomainParityTests`, `FormulaEngineTests`, `HarnessInjector` 패리티 존재 확인 | ✅ 유효. 단 패리티 범위가 도메인 계산기에 한정 → 수집/정성매도/스냅샷은 미커버 (**A2** 확장) |
+| WBS-10.7 Application 서비스 | 부분 완료 | 4개 서비스 구현 확인 | ✅ 유효 |
+
+> **핵심 시사점:** 기존 WBS-10 은 "완료" 표기가 실제보다 앞서 있다. 특히 보안(10.9)과 파이프라인(10.6)은 표기와 달리 **실질 미완성**이므로, 후속 작업은 표기를 신뢰하지 말고 본 문서의 실측 기준을 따른다.
+
+---
+
+## 3. 로드맵 (마이그레이션 완성 우선)
+
+```
+[P0 선행 게이트] 보안·위생 차단  ──►  반드시 먼저
+        │
+        ▼
+[Track A] 마이그레이션 완성 (PRIMARY)        [Track B] 상용 안정화 (SECONDARY, 병행)
+  A1 PipelineOrchestrator 실구현               B1 구성/시크릿 체계화
+  A2 패리티 하네스 확장(수집·정성매도)          B2 기본 인증(단일 사용자)
+  A3 데이터 수집 파이프라인 E2E 정합화          B3 헬스체크·메트릭
+  A4 정성매도/스냅샷 어드민 포팅                B4 재시도(Polly)·스케줄러
+  A5 GAS 잔여 14개 공식 이관                    B5 배포(Docker/CI 게이트)
+  A6 SQLite→PostgreSQL 단일화 + Python 폐기     B6 통합/E2E 테스트·커버리지 게이트
+```
+
+### 마일스톤
+
+| 마일스톤 | 구성 | 완료 기준 |
+|---|---|---|
+| **M1 위생 확보** | P0 | git 에서 시크릿/산출물 제거, 시크릿 외부화·회전 |
+| **M2 패리티 기반** | A1·A2 | `.NET` 도메인이 Python 골든 벡터와 1:1 일치, 실 파이프라인 산출 |
+| **M3 수집 자립** | A3·A4·B4 | `.NET` 단독 KIS→스냅샷→정성매도 무인 실행 |
+| **M4 단일 권위 전환** | A5·A6 | Python 런타임 의존 제거, `.NET` canonical 승격 |
+| **M5 상용 운영** | B1~B6 | 단일 사용자 보호·관측·배포 체계 가동 |
+
+---
+
+## 4. WBS (작업 분해 구조)
+
+각 항목: **목표 / 완료 판정(Acceptance) / 주요 파일 / 검증 명령**.
+
+### P0 — 선행 보안·위생 게이트 (🔴 Critical, 최우선)
+
+#### WBS-P0.1 빌드 산출물 git 추적 제거
+- **목표:** `.gitignore` 에 .NET 표준 패턴(`bin/`, `obj/`, `publish-output/`, `*.user`) 추가, 추적 중 산출물 `git rm -r --cached` 처리.
+- **판정:** `git status` 에 `bin/obj` 변경 미표시.
+- **파일:** `.gitignore`.
+- **검증:** `git status --porcelain | grep -E 'bin/|obj/'` → 0건.
+
+#### WBS-P0.2 하드코딩 시크릿 제거·회전
+- **목표:** `Program.cs:19` 텔레그램 토큰·채팅ID, `Program.cs:34` DB 패스워드 폴백을 환경변수/`dotnet user-secrets`/`appsettings.Production.json`(비추적)로 이전. 노출 토큰·DB 비밀번호 **회전**.
+- **판정:** 소스 전역 시크릿 평문 0건, 구성 누락 시 앱 기동 거부(fail-fast).
+- **파일:** `Program.cs`, `appsettings*.json`, `Infrastructure/TelegramSink.cs`.
+- **검증:** `Select-String -Pattern '8734507814|C8RFlZ9f' src/dotnet -Recurse` → 0건.
+
+#### WBS-P0.3 git 이력 시크릿 정리 (선택)
+- **목표:** 노출 토큰 회전 완료 시 이력 재작성 생략 가능. 회전 불가 시 `git filter-repo` 로 이력 제거 검토.
+- **판정:** 회전 완료 또는 이력 정리 완료 중 택1 기록.
+
+> **주의:** WBS-10.9 가 `완료` 로 표기되어 있으나 위 P0.1·P0.2 는 미해결 상태다. 본 게이트 완료 전까지 후속 트랙 착수를 보류한다.
+
+### Track A — 마이그레이션 완성 (PRIMARY)
+
+#### WBS-A1 PipelineOrchestrator 실제 구현
+- **목표:** `Task.Delay` 시뮬레이션 제거. 7단계(수집→정규화→팩터→결정→리스크게이트→리포트→영속화)를 실제 서비스 호출로 연결.
+- **판정:** 입력 스냅샷에 대해 결정 패킷 산출, 각 단계 결과가 `engine_history` 에 기록.
+- **파일:** `QuantEngine.Application/Services/PipelineOrchestrator.cs`, 관련 `Services/*`.
+- **검증:** `dotnet test --filter Pipeline` → 실데이터 기반 산출물 `gate: PASS`.
+
+#### WBS-A2 패리티 하네스 확장 (수집·정성매도)
+- **목표:** 기존 도메인 계산기 패리티(10.3~10.5)를 **수집 정규화·정성매도·하네스 주입 전체**로 확장. `spec/13_formula_registry.yaml`(149 공식) 기준 골든 벡터를 Python 에서 추출해 `.NET` 결과와 비교.
+- **판정:** 핵심 공식 전부 Python 과 동일 출력(부동소수 허용오차 내), 패리티 리포트 JSON 생성.
+- **파일:** `QuantEngine.Core.Tests/ParityTests/`, `tests/golden/`.
+- **검증:** `dotnet test --filter Parity` → 전건 PASS.
+
+#### WBS-A3 데이터 수집 파이프라인 E2E 정합화
+- **목표:** `DataCollectionService.cs`(구현됨)를 기준으로 WBS 표기 정합화, `kis_data_collection_v1.py` 잔여 로직 완전 이관, KIS→PostgreSQL 스냅샷 E2E 검증. Naver/Yahoo 폴백 다중화 명문화.
+- **판정:** `.NET` 단독 실데이터 수집·저장 성공, 폴백 동작 확인.
+- **파일:** `Application/Services/DataCollectionService.cs`, `Infrastructure/External/*`.
+
+#### WBS-A4 정성매도·스냅샷 어드민 포팅
+- **목표:** `qualitative_sell_strategy_v1.py`, `snapshot_admin_*_v1.py` 를 `.NET` 서비스/엔드포인트로 이관.
+- **판정:** 정성매도 5팩터 confluence 결과 Python 일치, 스냅샷 승인 워크플로우가 Web UI 에서 동작.
+- **파일:** `QuantEngine.Core/Domain/`, `QuantEngine.Web/Endpoints/`, `Components/Pages/`.
+
+#### WBS-A5 GAS 잔여 14개 공식 이관
+- **목표:** `governance/gas_logic_migration_ledger_v1.yaml` 의 TODO 14건을 `.NET` 포팅 + parity.
+- **판정:** 원장 전 항목 `status: DONE`, parity 통과.
+- **파일:** `QuantEngine.Core/Domain/`, `governance/gas_logic_migration_ledger_v1.yaml`.
+
+#### WBS-A6 SQLite→PostgreSQL 단일화 및 Python 런타임 폐기
+- **목표:** canonical DB 를 PostgreSQL 로 일원화, `src/quant_engine/*.db` 의존 제거, Python 런타임 도구를 `.NET`/`Tools` 로 대체.
+- **판정:** 운영 경로 Python 호출 0건, 모든 데이터 PostgreSQL 단일 소스.
+- **파일:** `Infrastructure/Data/DbMigrator.cs`, `Makefile`, `tools/`.
+
+#### WBS-A7 UI 프레임워크 전환 — Fluent UI → MudBlazor + Interactive WebAssembly (2026-06-30 방침)
+- **배경:** UI 표준을 **MudBlazor** 컴포넌트 + **Interactive WebAssembly** 렌더 모드 + **API-First** 로 전환(방침 확정). 기존 Fluent UI v5 / InteractiveServer 는 폐기. 정책은 [CLAUDE.md](../CLAUDE.md) 및 [AGENTS.md](../AGENTS.md) §5b 에 반영 완료.
+- **목표:**
+  - csproj 패키지 교체: `Microsoft.FluentUI.AspNetCore.Components*` 제거 → `MudBlazor` 추가.
+  - 렌더 모드 전환: `Program.cs` 의 `AddInteractiveServerComponents`/`AddInteractiveServerRenderMode` → `AddInteractiveWebAssemblyComponents`/`AddInteractiveWebAssemblyRenderMode`, 클라이언트 프로젝트(`QuantEngine.Web.Client`) 분리.
+  - `App.razor`: Fluent CSS/JS·`FluentDesignSystemProvider` 제거 → MudBlazor `<MudThemeProvider>`/`<MudDialogProvider>`/`<MudSnackbarProvider>` + `MudBlazor.min.css/js` 삽입.
+  - 전체 `.razor` 컴포넌트의 `Fluent*` → `Mud*` 치환(매핑표는 [CLAUDE.md](../CLAUDE.md) Component Mapping 참조).
+  - API-First: UI 의 직접 DI 호출을 `IXxxBrowserClient`(HTTP) 경유로 전환, `TokenRefreshHandler` 패턴 적용.
+- **판정:** Fluent UI 패키지/참조 0건, `dotnet build` 오류 0, WASM 로드 후 `/quant/` 및 주요 페이지 정상 렌더, 비-API 라우트 동작 확인.
+- **주요 파일:** `QuantEngine.Web/QuantEngine.Web.csproj`, `Program.cs`, `Components/App.razor`, `Components/Layout/*.razor`, `Components/Pages/*.razor`, 신규 `QuantEngine.Web.Client/`.
+- **검증:** `Select-String -Pattern 'Fluent' src/dotnet/QuantEngine.Web -Recurse` → 0건; 브라우저에서 WASM 모드 동작 확인.
+
+### Track B — 상용 안정화 (SECONDARY, 단일 사용자)
+
+#### WBS-B1 구성·시크릿 체계화
+- **목표:** `appsettings.Production.json`(비추적), `IOptions<T>` + 시작 시 구성 검증(fail-fast), 연결 문자열/토큰 환경변수 표준화.
+- **판정:** 개발/운영 구성 분리, 필수 구성 누락 시 명확 오류로 기동 중단.
+
+#### WBS-B2 기본 인증 (단일 사용자 보호)
+- **목표:** 공개 서버 노출 방어용 최소 인증 — 리버스 프록시 Basic Auth 또는 API Key 미들웨어 1종(`/api/*`·UI 보호). 본격 Identity/JWT 는 범위 외.
+- **판정:** 비인증 요청 401, 인증 요청만 수집/조회 가능.
+- **파일:** `Program.cs`, `Endpoints/CollectionEndpoints.cs`, Nginx 구성.
+
+#### WBS-B3 헬스체크·메트릭
+- **목표:** `MapHealthChecks("/health")`(liveness) + `/health/ready`(PostgreSQL/KIS 토큰 점검), `prometheus-net` 기반 기본 메트릭.
+- **판정:** 배포 스크립트 헬스체크가 `/health/ready` 사용, 메트릭 엔드포인트 응답.
+- **파일:** `Program.cs`, `.gitea/workflows/deploy-prod.yml`.
+
+#### WBS-B4 재시도(Polly)·백그라운드 스케줄러
+- **목표:** KIS/Naver/Yahoo HTTP 호출에 Polly 재시도·서킷브레이커, 주기적 수집을 `BackgroundService`(또는 systemd timer 연계)로 자동화.
+- **판정:** 일시적 5xx/네트워크 오류 자동 복구, 정해진 스케줄 무인 수집.
+- **파일:** `Program.cs`(HttpClient+Polly), 신규 `Application/Services/*BackgroundService.cs`.
+
+#### WBS-B5 배포 (Docker/CI 게이트)
+- **목표:** 멀티스테이지 `Dockerfile` + `docker-compose.yml`(app+PostgreSQL), `.gitea` CI 에 `dotnet build`+`dotnet test` 게이트 추가.
+- **판정:** 컨테이너 로컬 기동 성공, CI 에서 테스트 실패 시 배포 차단.
+- **파일:** 신규 `Dockerfile`, `docker-compose.yml`, `.gitea/workflows/ci.yml`.
+
+#### WBS-B6 통합·E2E 테스트 및 커버리지 게이트
+- **목표:** Testcontainers(PostgreSQL) 통합테스트, KIS→스냅샷→정성매도 E2E, coverlet 커버리지 임계값을 CI 게이트로 연결.
+- **판정:** E2E 1건 이상 그린, 커버리지 임계 미달 시 CI 실패.
+- **파일:** `QuantEngine.Core.Tests/`(통합/E2E), `.gitea/workflows/ci.yml`.
+
+---
+
+## 5. 개선·보완·고도화 제안 (Track A/B 외 권고)
+
+- **결정 재현성 감사:** 동일 입력 → 동일 출력 결정론 검증을 CI 상시 게이트로 편입 ([governance/adr/0003-no-llm-numeric-generation.md](../governance/adr/0003-no-llm-numeric-generation.md) 정신 계승).
+- **캘리브레이션 실증 연계:** [spec/27_bch_calibration_runbook.yaml](../spec/27_bch_calibration_runbook.yaml) 의 `0/190 CALIBRATED` 문제를 마이그레이션과 분리된 데이터 트랙으로 별도 추적(본 WBS 범위 밖, 링크 유지).
+- **장애 단일점 보강:** Naver Cloudflare 403 폴백 경로를 Yahoo/KIS 다중화로 명문화(WBS-A3 연동).
+- **운영 가시성:** 구조화 로깅에 상관관계 ID(correlation id) 추가, 수집 실행별 추적 가능화.
+- **비밀 회전 정책:** KIS appkey/secret, 텔레그램 토큰, DB 비밀번호의 주기적 회전 절차를 [docs/runbook.md](./runbook.md) 에 문서화.
+- **WBS 표기 정합성 거버넌스:** 본 문서에서 드러난 "완료 표기 vs 실측" 괴리 재발 방지를 위해, 각 WBS 완료 시 **검증 명령 출력 캡처를 증빙으로 첨부**하는 규칙을 강화([AGENTS.md](../AGENTS.md) 의 검증·증빙 강제 원칙 적용).
+
+---
+
+## 6. 검증 방법 (각 단계 실행 시)
+
+- **P0:** `git status` 산출물 미추적 확인, 시크릿 평문 grep 0건, 회전된 자격증명으로 정상 기동.
+- **Track A:** `cd src/dotnet && dotnet test` 로 패리티/단위/E2E 그린. 패리티 리포트 JSON 을 Python 출력과 diff. 운영 경로 Python 호출 0건.
+- **Track B:** `curl /health/ready` 200, 비인증 요청 401, `docker compose up` 기동, CI 테스트/커버리지 게이트 동작. Polly 재시도는 장애 주입 테스트로 검증.
+
+---
+
+## 7. 실행 순서 요약
+
+1. **P0 선행 게이트** (WBS-P0.1~P0.3) — 보안·위생 차단. **(기존 10.9 完了 표기 무시, 실측 기준 처리)**
+2. **Track A** (A1→A2→A3→A4→A5→A6) — 마이그레이션 완성(우선).
+3. **Track B** (B1~B6) — 단일 사용자 상용 안정화(A 와 병행, B1·B3 조기 착수 권장).

src/dotnet/QuantEngine.Core.Tests/ApplicationServiceTests.cs

@@ -123,6 +123,12 @@ public class ApplicationServiceTests
         public (string Domain, string TargetRef)? LastReleasedLock { get; private set; }
 
         public Task<IEnumerable<Setting>> GetSettingsAsync() => Task.FromResult(Enumerable.Empty<Setting>());
+        public Task<IEnumerable<WorkspaceAccount>> GetAccountsAsync() => Task.FromResult(Enumerable.Empty<WorkspaceAccount>());
+        public Task<WorkspaceAccount?> GetAccountByUsernameAsync(string username) => Task.FromResult<WorkspaceAccount?>(null);
+        public Task<bool> UpsertAccountAsync(WorkspaceAccount account) => Task.FromResult(true);
+        public Task<WorkspaceSession?> GetSessionByTokenHashAsync(string tokenHash) => Task.FromResult<WorkspaceSession?>(null);
+        public Task<bool> UpsertSessionAsync(WorkspaceSession session) => Task.FromResult(true);
+        public Task<bool> RevokeSessionAsync(string tokenHash, string revokedAt) => Task.FromResult(true);
         public Task<Setting?> GetSettingByKeyAsync(string key) => Task.FromResult<Setting?>(null);
         public Task<bool> UpsertSettingAsync(Setting setting) { LastSetting = setting; return Task.FromResult(true); }
         public Task<bool> DeleteSettingAsync(string key) => Task.FromResult(true);

src/dotnet/QuantEngine.Core/Interfaces/IWorkspaceRepository.cs

@@ -6,6 +6,14 @@ namespace QuantEngine.Core.Interfaces
 {
     public interface IWorkspaceRepository
     {
+        // Accounts
+        Task<IEnumerable<WorkspaceAccount>> GetAccountsAsync();
+        Task<WorkspaceAccount?> GetAccountByUsernameAsync(string username);
+        Task<bool> UpsertAccountAsync(WorkspaceAccount account);
+        Task<WorkspaceSession?> GetSessionByTokenHashAsync(string tokenHash);
+        Task<bool> UpsertSessionAsync(WorkspaceSession session);
+        Task<bool> RevokeSessionAsync(string tokenHash, string revokedAt);
+
         // Settings
         Task<IEnumerable<Setting>> GetSettingsAsync();
         Task<Setting?> GetSettingByKeyAsync(string key);

src/dotnet/QuantEngine.Core/Models/WorkspaceAccount.cs

@@ -0,0 +1,13 @@
+namespace QuantEngine.Core.Models
+{
+    public class WorkspaceAccount
+    {
+        public int Ordinal { get; set; }
+        public string Username { get; set; } = string.Empty;
+        public string PasswordHash { get; set; } = string.Empty;
+        public string Role { get; set; } = "Admin";
+        public string IsActive { get; set; } = "true";
+        public string CreatedAt { get; set; } = string.Empty;
+        public string UpdatedAt { get; set; } = string.Empty;
+    }
+}

src/dotnet/QuantEngine.Core/Models/WorkspaceSession.cs

@@ -0,0 +1,12 @@
+namespace QuantEngine.Core.Models
+{
+    public class WorkspaceSession
+    {
+        public string SessionTokenHash { get; set; } = string.Empty;
+        public string Username { get; set; } = string.Empty;
+        public string Role { get; set; } = "Admin";
+        public string CreatedAt { get; set; } = string.Empty;
+        public string ExpiresAt { get; set; } = string.Empty;
+        public string? RevokedAt { get; set; }
+    }
+}

src/dotnet/QuantEngine.Infrastructure/Data/DbMigrator.cs

@@ -30,6 +30,32 @@ namespace QuantEngine.Infrastructure.Data
                 );
             ");
 
+            // 0b. workspace_account
+            conn.Execute(@"
+                CREATE TABLE IF NOT EXISTS workspace_account (
+                    ordinal INT NOT NULL,
+                    username TEXT PRIMARY KEY,
+                    password_hash TEXT NOT NULL,
+                    role TEXT NOT NULL DEFAULT 'Admin',
+                    is_active TEXT NOT NULL DEFAULT 'true',
+                    created_at TEXT NOT NULL,
+                    updated_at TEXT NOT NULL
+                );
+                CREATE INDEX IF NOT EXISTS idx_workspace_account_active ON workspace_account(is_active, username);
+            ");
+
+            conn.Execute(@"
+                CREATE TABLE IF NOT EXISTS workspace_session (
+                    session_token_hash TEXT PRIMARY KEY,
+                    username TEXT NOT NULL,
+                    role TEXT NOT NULL DEFAULT 'Admin',
+                    created_at TEXT NOT NULL,
+                    expires_at TEXT NOT NULL,
+                    revoked_at TEXT
+                );
+                CREATE INDEX IF NOT EXISTS idx_workspace_session_username ON workspace_session(username, expires_at DESC);
+            ");
+
             // 1. collection_runs
             conn.Execute(@"
                 CREATE TABLE IF NOT EXISTS collection_runs (
@@ -157,6 +183,16 @@ namespace QuantEngine.Infrastructure.Data
                 );
             ");
 
+            conn.Execute(@"
+                INSERT INTO quantengine.workspace_account (
+                    ordinal, username, password_hash, role, is_active, created_at, updated_at
+                )
+                SELECT 1, 'admin', '8C6976E5B5410415BDE908BD4DEE15DFB167A9C873FC4BB8A81F6F2AB448A918', 'Admin', 'true', NOW()::text, NOW()::text
+                WHERE NOT EXISTS (
+                    SELECT 1 FROM quantengine.workspace_account WHERE username = 'admin'
+                );
+            ");
+
             // 10. engine_history schema and tables
             conn.Execute(@"
                 CREATE SCHEMA IF NOT EXISTS engine_history;

src/dotnet/QuantEngine.Infrastructure/Repositories/WorkspaceRepository.cs

@@ -17,6 +17,89 @@ namespace QuantEngine.Infrastructure.Repositories
             _connectionFactory = connectionFactory;
         }
 
+        // Accounts
+        public async Task<IEnumerable<WorkspaceAccount>> GetAccountsAsync()
+        {
+            using var conn = _connectionFactory.CreateConnection();
+            return await conn.QueryAsync<WorkspaceAccount>(@"
+                SELECT ordinal, username as Username, password_hash as PasswordHash, role as Role,
+                       is_active as IsActive, created_at as CreatedAt, updated_at as UpdatedAt
+                FROM quantengine.workspace_account
+                ORDER BY ordinal ASC"
+            );
+        }
+
+        public async Task<WorkspaceAccount?> GetAccountByUsernameAsync(string username)
+        {
+            using var conn = _connectionFactory.CreateConnection();
+            return await conn.QueryFirstOrDefaultAsync<WorkspaceAccount>(@"
+                SELECT ordinal, username as Username, password_hash as PasswordHash, role as Role,
+                       is_active as IsActive, created_at as CreatedAt, updated_at as UpdatedAt
+                FROM quantengine.workspace_account
+                WHERE username = @Username",
+                new { Username = username }
+            );
+        }
+
+        public async Task<bool> UpsertAccountAsync(WorkspaceAccount account)
+        {
+            using var conn = _connectionFactory.CreateConnection();
+            var affected = await conn.ExecuteAsync(@"
+                INSERT INTO quantengine.workspace_account (ordinal, username, password_hash, role, is_active, created_at, updated_at)
+                VALUES (@Ordinal, @Username, @PasswordHash, @Role, @IsActive, @CreatedAt, @UpdatedAt)
+                ON CONFLICT (username) DO UPDATE SET
+                    ordinal = EXCLUDED.ordinal,
+                    password_hash = EXCLUDED.password_hash,
+                    role = EXCLUDED.role,
+                    is_active = EXCLUDED.is_active,
+                    updated_at = EXCLUDED.updated_at",
+                account
+            );
+            return affected > 0;
+        }
+
+        public async Task<WorkspaceSession?> GetSessionByTokenHashAsync(string tokenHash)
+        {
+            using var conn = _connectionFactory.CreateConnection();
+            return await conn.QueryFirstOrDefaultAsync<WorkspaceSession>(@"
+                SELECT session_token_hash as SessionTokenHash, username as Username, role as Role,
+                       created_at as CreatedAt, expires_at as ExpiresAt, revoked_at as RevokedAt
+                FROM quantengine.workspace_session
+                WHERE session_token_hash = @TokenHash",
+                new { TokenHash = tokenHash }
+            );
+        }
+
+        public async Task<bool> UpsertSessionAsync(WorkspaceSession session)
+        {
+            using var conn = _connectionFactory.CreateConnection();
+            var affected = await conn.ExecuteAsync(@"
+                INSERT INTO quantengine.workspace_session
+                    (session_token_hash, username, role, created_at, expires_at, revoked_at)
+                VALUES
+                    (@SessionTokenHash, @Username, @Role, @CreatedAt, @ExpiresAt, @RevokedAt)
+                ON CONFLICT (session_token_hash) DO UPDATE SET
+                    username = EXCLUDED.username,
+                    role = EXCLUDED.role,
+                    expires_at = EXCLUDED.expires_at,
+                    revoked_at = EXCLUDED.revoked_at",
+                session
+            );
+            return affected > 0;
+        }
+
+        public async Task<bool> RevokeSessionAsync(string tokenHash, string revokedAt)
+        {
+            using var conn = _connectionFactory.CreateConnection();
+            var affected = await conn.ExecuteAsync(@"
+                UPDATE quantengine.workspace_session
+                SET revoked_at = @RevokedAt
+                WHERE session_token_hash = @TokenHash",
+                new { TokenHash = tokenHash, RevokedAt = revokedAt }
+            );
+            return affected > 0;
+        }
+
         // Settings
         public async Task<IEnumerable<Setting>> GetSettingsAsync()
         {

src/dotnet/QuantEngine.Web/Client/Infrastructure/CustomAuthenticationStateProvider.cs

@@ -7,25 +7,42 @@ namespace QuantEngine.Web.Client.Infrastructure
     public class CustomAuthenticationStateProvider : AuthenticationStateProvider
     {
         private readonly LocalStorageService _localStorage;
+        private readonly HttpClient _http;
         private readonly ClaimsPrincipal _anonymous = new ClaimsPrincipal(new ClaimsIdentity());
-        private const string StorageKey = "quant_admin_session";
+        private const string TokenKey = "quant_admin_access_token";
+        private const string UsernameKey = "quant_admin_username";
+        private const string RoleKey = "quant_admin_role";
+        private const string RememberUsernameKey = "quant_admin_remember_username";
 
-        public CustomAuthenticationStateProvider(LocalStorageService localStorage)
+        public CustomAuthenticationStateProvider(LocalStorageService localStorage, HttpClient http)
         {
             _localStorage = localStorage;
+            _http = http;
         }
 
         public override async Task<AuthenticationState> GetAuthenticationStateAsync()
         {
             try
             {
-                var username = await _localStorage.GetAsync<string>(StorageKey);
-                if (!string.IsNullOrEmpty(username))
+                var token = await _localStorage.GetAsync<string>(TokenKey);
+                var username = await _localStorage.GetAsync<string>(UsernameKey);
+                var role = await _localStorage.GetAsync<string>(RoleKey) ?? "Admin";
+
+                if (!string.IsNullOrWhiteSpace(token) && !string.IsNullOrWhiteSpace(username))
                 {
+                    var request = new HttpRequestMessage(HttpMethod.Get, "api/auth/me");
+                    request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);
+                    var response = await _http.SendAsync(request);
+                    if (!response.IsSuccessStatusCode)
+                    {
+                        await MarkUserAsLoggedOutAsync();
+                        return new AuthenticationState(_anonymous);
+                    }
+
                     var identity = new ClaimsIdentity(new[]
                     {
                         new Claim(ClaimTypes.Name, username),
-                        new Claim(ClaimTypes.Role, "Admin")
+                        new Claim(ClaimTypes.Role, role)
                     }, "QuantAdminAuth");
 
                     var user = new ClaimsPrincipal(identity);
@@ -40,14 +57,30 @@ namespace QuantEngine.Web.Client.Infrastructure
             return new AuthenticationState(_anonymous);
         }
 
-        public async Task MarkUserAsAuthenticatedAsync(string username)
+        public async Task MarkUserAsAuthenticatedAsync(string username, string accessToken, string role)
         {
-            await _localStorage.SetAsync(StorageKey, username);
+            await MarkUserAsAuthenticatedAsync(username, accessToken, role, rememberUsername: true);
+        }
+
+        public async Task MarkUserAsAuthenticatedAsync(string username, string accessToken, string role, bool rememberUsername)
+        {
+            await _localStorage.SetAsync(TokenKey, accessToken);
+            if (rememberUsername)
+            {
+                await _localStorage.SetAsync(UsernameKey, username);
+                await _localStorage.SetAsync(RememberUsernameKey, true);
+            }
+            else
+            {
+                await _localStorage.DeleteAsync(UsernameKey);
+                await _localStorage.SetAsync(RememberUsernameKey, false);
+            }
+            await _localStorage.SetAsync(RoleKey, role);
 
             var identity = new ClaimsIdentity(new[]
             {
                 new Claim(ClaimTypes.Name, username),
-                new Claim(ClaimTypes.Role, "Admin")
+                new Claim(ClaimTypes.Role, role)
             }, "QuantAdminAuth");
 
             var user = new ClaimsPrincipal(identity);
@@ -56,8 +89,45 @@ namespace QuantEngine.Web.Client.Infrastructure
 
         public async Task MarkUserAsLoggedOutAsync()
         {
-            await _localStorage.DeleteAsync(StorageKey);
+            await _localStorage.DeleteAsync(TokenKey);
+            await _localStorage.DeleteAsync(RoleKey);
+            var rememberUsername = await _localStorage.GetAsync<bool>(RememberUsernameKey);
+            if (!rememberUsername)
+            {
+                await _localStorage.DeleteAsync(UsernameKey);
+            }
             NotifyAuthenticationStateChanged(Task.FromResult(new AuthenticationState(_anonymous)));
         }
+
+        public async Task LogoutFromServerAsync()
+        {
+            var token = await _localStorage.GetAsync<string>(TokenKey);
+            if (!string.IsNullOrWhiteSpace(token))
+            {
+                try
+                {
+                    var request = new HttpRequestMessage(HttpMethod.Post, "api/auth/logout");
+                    request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);
+                    await _http.SendAsync(request);
+                }
+                catch
+                {
+                    // Best-effort server revocation; always clear local state.
+                }
+            }
+
+            await MarkUserAsLoggedOutAsync();
+        }
+
+        public async Task<string?> GetRememberedUsernameAsync()
+        {
+            var rememberUsername = await _localStorage.GetAsync<bool>(RememberUsernameKey);
+            if (!rememberUsername)
+            {
+                return null;
+            }
+
+            return await _localStorage.GetAsync<string>(UsernameKey);
+        }
     }
 }

src/dotnet/QuantEngine.Web/Client/Layout/AuthLayout.razor

@@ -0,0 +1,3 @@
+@inherits LayoutComponentBase
+
+@Body

src/dotnet/QuantEngine.Web/Client/Layout/MainLayout.razor

@@ -2,74 +2,36 @@
 @inject HttpClient Http
 @inject AuthenticationStateProvider AuthStateProvider
 @inject NavigationManager NavigationManager
-@using System.Net.Http.Json
-@using Microsoft.FluentUI.AspNetCore.Components
-@using QuantEngine.Web.Client.Infrastructure
 
-<FluentStack Orientation="Orientation.Vertical" Class="h-100 w-100">
-    <!-- Header -->
-    <FluentHeader>
-        <FluentStack Orientation="Orientation.Horizontal" VerticalAlignment="VerticalAlignment.Center"
-                     Style="width: 100%; padding: 8px 16px; gap: 16px;">
-            <FluentButton OnClick="@(() => navOpen = !navOpen)"
-                         Title="Toggle Navigation"
-                         Style="background: transparent; border: none; cursor: pointer;">
-                ☰
-            </FluentButton>
-            <h1 style="margin: 0; font-size: 20px; font-weight: 600;">QuantEngine v@appVersion</h1>
-            <AuthorizeView>
-                <Authorized>
-                    <div style="margin-left: auto; display: flex; align-items: center; gap: 12px;">
-                        <span style="font-size: 13px; color: var(--neutral-foreground-hint);">관리자 (@context.User.Identity?.Name)</span>
-                        <FluentButton OnClick="HandleLogoutAsync" Style="color: #ff5252; background: transparent; border: 1px solid rgba(255, 82, 82, 0.2); cursor: pointer; padding: 4px 12px; border-radius: 4px;">
-                            로그아웃
-                        </FluentButton>
-                    </div>
-                </Authorized>
-            </AuthorizeView>
-        </FluentStack>
-    </FluentHeader>
+<MudLayout>
+    <MudAppBar Elevation="1" Dense="true">
+        <MudIconButton Icon="@Icons.Material.Filled.Menu" Color="Color.Inherit" Edge="Edge.Start" OnClick="@(() => navOpen = !navOpen)" />
+        <MudText Typo="Typo.h6">QuantEngine v@appVersion</MudText>
+        <MudSpacer />
+        <AuthorizeView>
+            <Authorized>
+                <MudText Typo="Typo.body2">관리자 (@context.User.Identity?.Name)</MudText>
+                <MudButton Variant="Variant.Outlined" Color="Color.Error" OnClick="HandleLogoutAsync">로그아웃</MudButton>
+            </Authorized>
+        </AuthorizeView>
+    </MudAppBar>
 
-    <!-- Main Content Area -->
-    <FluentStack Orientation="Orientation.Horizontal" Class="flex-1" Style="overflow: hidden;">
-        <!-- Navigation Sidebar -->
-        @if (navOpen)
-        {
-            <nav style="width: 240px; background: var(--neutral-layer-1); border-right: 1px solid var(--neutral-stroke-1); padding: 12px; overflow-y: auto;">
-                <NavMenu />
-                <div style="margin-top: auto; padding-top: 12px; border-top: 1px solid var(--neutral-stroke-1); margin-top: 12px; font-size: 11px; color: var(--neutral-foreground-3); line-height: 1.5;">
-                    <div style="font-weight: 500; margin-bottom: 2px;">QuantEngine v@appVersion</div>
-                    <div style="font-size: 10px; opacity: 0.85;">배포: @buildTime</div>
-                </div>
-            </nav>
-        }
+    <MudDrawer Open="@navOpen" Variant="DrawerVariant.Responsive" Elevation="1">
+        <MudNavMenu>
+            <NavMenu />
+        </MudNavMenu>
+        <div style="padding: 16px; border-top: 1px solid var(--mud-palette-lines-default);">
+            <MudText Typo="Typo.caption">QuantEngine v@appVersion</MudText>
+            <MudText Typo="Typo.caption">배포: @buildTime</MudText>
+        </div>
+    </MudDrawer>
 
-        <!-- Page Content -->
-        <FluentStack Orientation="Orientation.Vertical" Class="flex-1" Style="overflow-y: auto; padding: 24px;">
+    <MudMainContent>
+        <MudContainer MaxWidth="MaxWidth.False" Class="pa-4">
             @Body
-        </FluentStack>
-    </FluentStack>
-</FluentStack>
-
-<div id="blazor-error-ui" data-nosnippet>
-    <div class="alert alert-danger" role="alert">
-        <p>An unhandled error has occurred.</p>
-        <a href="." class="btn btn-primary">Reload</a>
-    </div>
-</div>
-
-<style>
-    .h-100 {
-        height: 100%;
-    }
-    .w-100 {
-        width: 100%;
-    }
-    .flex-1 {
-        flex: 1;
-        display: flex;
-    }
-</style>
+        </MudContainer>
+    </MudMainContent>
+</MudLayout>
 
 @code {
     private bool navOpen = true;
@@ -89,15 +51,14 @@
         }
         catch
         {
-            // Fail-safe default fallback values
         }
     }
 
     private async Task HandleLogoutAsync()
     {
         var customProvider = (CustomAuthenticationStateProvider)AuthStateProvider;
-        await customProvider.MarkUserAsLoggedOutAsync();
-        NavigationManager.NavigateTo("login");
+        await customProvider.LogoutFromServerAsync();
+        NavigationManager.NavigateTo("/login");
     }
 
     private class VersionInfo
@@ -106,4 +67,3 @@
         public string? Built { get; set; }
     }
 }
-

src/dotnet/QuantEngine.Web/Client/Layout/NavMenu.razor

@@ -1,10 +1,4 @@
-@using Microsoft.FluentUI.AspNetCore.Components
-
-<FluentNavMenu>
-    <FluentNavLink Href="/" Match="NavLinkMatch.All">
-        Dashboard
-    </FluentNavLink>
-    <FluentNavLink Href="/operations" Match="NavLinkMatch.Prefix">
-        Operations
-    </FluentNavLink>
-</FluentNavMenu>
+<MudNavMenu>
+    <MudNavLink Href="/dashboard" Match="NavLinkMatch.All">Dashboard</MudNavLink>
+    <MudNavLink Href="/operations" Match="NavLinkMatch.Prefix">Operations</MudNavLink>
+</MudNavMenu>

src/dotnet/QuantEngine.Web/Client/Pages/Collection.razor

@@ -6,118 +6,88 @@
 
 <PageTitle>QuantEngine - Collection</PageTitle>
 
-<h1 style="margin: 0 0 8px 0; font-size: 28px; font-weight: 600;">Data Collection</h1>
-<p style="margin: 0 0 16px 0; color: var(--neutral-foreground-2); font-size: 14px;">
-    KIS API data collection dashboard. Monitor runs, snapshots, and error trends.
-</p>
+<MudText Typo="Typo.h4" Class="mb-2">Data Collection</MudText>
+<MudText Typo="Typo.body2" Class="mb-4">KIS API data collection dashboard. API-first로만 동작합니다.</MudText>
 
-<!-- Controls -->
-<FluentStack Orientation="Orientation.Horizontal" HorizontalGap="8" Style="margin-bottom: 16px;">
-    <FluentButton Appearance="ButtonAppearance.Primary" OnClick="@StartCollectionAsync" Disabled="@IsProcessing">
-        @if (IsProcessing) { <span>Running...</span> } else { <span>Start Collection</span> }
-    </FluentButton>
-    <FluentButton Appearance="ButtonAppearance.Default" OnClick="@RefreshAsync" Disabled="@IsProcessing">
-        Refresh
-    </FluentButton>
-</FluentStack>
+<MudStack Row="true" Spacing="2" Class="mb-4">
+    <MudButton Variant="Variant.Filled" Color="Color.Primary" OnClick="@StartCollectionAsync" Disabled="@IsProcessing">
+        @(IsProcessing ? "Running..." : "Start Collection")
+    </MudButton>
+    <MudButton Variant="Variant.Outlined" OnClick="@RefreshAsync" Disabled="@IsProcessing">Refresh</MudButton>
+</MudStack>
 
-<!-- Loading skeleton -->
 @if (IsLoading)
 {
-    <FluentStack Orientation="Orientation.Vertical" VerticalGap="16">
-        <FluentSkeleton Width="100%" Height="60px" />
-        <FluentSkeleton Width="100%" Height="200px" />
-    </FluentStack>
+    <MudProgressLinear Indeterminate="true" Color="Color.Primary" Class="mb-4" />
 }
 else if (DashboardState != null)
 {
-    <!-- Summary Cards -->
-    <FluentStack Orientation="Orientation.Horizontal" HorizontalGap="16" Wrap="true" Style="margin-bottom: 16px;">
-        <FluentCard Style="flex: 1; min-width: 150px;">
-            <div style="padding: 16px;">
-                <p style="margin: 0 0 8px 0; color: var(--neutral-foreground-2); font-size: 12px; font-weight: 500;">Last Run</p>
-                <h3 style="margin: 0; font-size: 18px; font-weight: 600;">@(DashboardState.LastRunStatus ?? "N/A")</h3>
-                <p style="margin: 8px 0 0 0; color: var(--neutral-foreground-3); font-size: 12px;">@(DashboardState.LastFinishedAt ?? "Not finished")</p>
-            </div>
-        </FluentCard>
-        <FluentCard Style="flex: 1; min-width: 150px;">
-            <div style="padding: 16px;">
-                <p style="margin: 0 0 8px 0; color: var(--neutral-foreground-2); font-size: 12px; font-weight: 500;">Total Snapshots</p>
-                <h3 style="margin: 0; font-size: 18px; font-weight: 600;">@DashboardState.TotalSnapshots</h3>
-            </div>
-        </FluentCard>
-        <FluentCard Style="flex: 1; min-width: 150px;">
-            <div style="padding: 16px;">
-                <p style="margin: 0 0 8px 0; color: var(--neutral-foreground-2); font-size: 12px; font-weight: 500;">Total Errors</p>
-                <h3 style="margin: 0; font-size: 18px; font-weight: 600;">@DashboardState.TotalErrors</h3>
-            </div>
-        </FluentCard>
-    </FluentStack>
+    <MudGrid Spacing="2" Class="mb-4">
+        <MudItem xs="12" sm="4">
+            <MudPaper Class="pa-4" Elevation="2">
+                <MudText Typo="Typo.caption">Last Run</MudText>
+                <MudText Typo="Typo.h6">@(DashboardState.LastRunStatus ?? "N/A")</MudText>
+                <MudText Typo="Typo.body2">@(DashboardState.LastFinishedAt ?? "Not finished")</MudText>
+            </MudPaper>
+        </MudItem>
+        <MudItem xs="12" sm="4">
+            <MudPaper Class="pa-4" Elevation="2">
+                <MudText Typo="Typo.caption">Total Snapshots</MudText>
+                <MudText Typo="Typo.h6">@DashboardState.TotalSnapshots</MudText>
+            </MudPaper>
+        </MudItem>
+        <MudItem xs="12" sm="4">
+            <MudPaper Class="pa-4" Elevation="2">
+                <MudText Typo="Typo.caption">Total Errors</MudText>
+                <MudText Typo="Typo.h6">@DashboardState.TotalErrors</MudText>
+            </MudPaper>
+        </MudItem>
+    </MudGrid>
 
-    <!-- Recent Errors -->
     @if (DashboardState.RecentErrors.Count > 0)
     {
-        <FluentCard Style="margin-bottom: 16px;">
-            <div style="padding: 16px;">
-                <h3 style="margin: 0 0 12px 0; font-size: 16px; font-weight: 600;">Recent Errors</h3>
-                <table style="width: 100%; border-collapse: collapse;">
-                    <thead style="background: var(--neutral-subtle);">
-                        <tr>
-                            <th style="padding: 8px; text-align: left; border-bottom: 1px solid var(--neutral-divider-rest);">Source</th>
-                            <th style="padding: 8px; text-align: left; border-bottom: 1px solid var(--neutral-divider-rest);">Kind</th>
-                            <th style="padding: 8px; text-align: left; border-bottom: 1px solid var(--neutral-divider-rest);">Ticker</th>
-                            <th style="padding: 8px; text-align: left; border-bottom: 1px solid var(--neutral-divider-rest);">Message</th>
-                        </tr>
-                    </thead>
-                    <tbody>
-                        @foreach (var error in DashboardState.RecentErrors)
-                        {
-                            <tr>
-                                <td style="padding: 8px; border-bottom: 1px solid var(--neutral-stroke-divider-rest);">@error.SourceName</td>
-                                <td style="padding: 8px; border-bottom: 1px solid var(--neutral-stroke-divider-rest);">@error.ErrorKind</td>
-                                <td style="padding: 8px; border-bottom: 1px solid var(--neutral-stroke-divider-rest);">@error.Ticker</td>
-                                <td style="padding: 8px; border-bottom: 1px solid var(--neutral-stroke-divider-rest);">@error.ErrorMessage</td>
-                            </tr>
-                        }
-                    </tbody>
-                </table>
-            </div>
-        </FluentCard>
+        <MudPaper Class="pa-4 mb-4" Elevation="2">
+            <MudText Typo="Typo.h6" Class="mb-3">Recent Errors</MudText>
+            <MudTable Items="@DashboardState.RecentErrors" Dense="true" Hover="true">
+                <HeaderContent>
+                    <MudTh>Source</MudTh>
+                    <MudTh>Kind</MudTh>
+                    <MudTh>Ticker</MudTh>
+                    <MudTh>Message</MudTh>
+                </HeaderContent>
+                <RowTemplate>
+                    <MudTd DataLabel="Source">@context.SourceName</MudTd>
+                    <MudTd DataLabel="Kind">@context.ErrorKind</MudTd>
+                    <MudTd DataLabel="Ticker">@context.Ticker</MudTd>
+                    <MudTd DataLabel="Message">@context.ErrorMessage</MudTd>
+                </RowTemplate>
+            </MudTable>
+        </MudPaper>
     }
 
-    <!-- Recent Runs -->
     @if (RecentRuns != null && RecentRuns.Count > 0)
     {
-        <FluentCard>
-            <div style="padding: 16px;">
-                <h3 style="margin: 0 0 12px 0; font-size: 16px; font-weight: 600;">Recent Runs</h3>
-                <table style="width: 100%; border-collapse: collapse;">
-                    <thead style="background: var(--neutral-subtle);">
-                        <tr>
-                            <th style="padding: 8px; text-align: left; border-bottom: 1px solid var(--neutral-divider-rest);">Run ID</th>
-                            <th style="padding: 8px; text-align: left; border-bottom: 1px solid var(--neutral-divider-rest);">Status</th>
-                            <th style="padding: 8px; text-align: left; border-bottom: 1px solid var(--neutral-divider-rest);">Started</th>
-                            <th style="padding: 8px; text-align: left; border-bottom: 1px solid var(--neutral-divider-rest);">Finished</th>
-                            <th style="padding: 8px; text-align: left; border-bottom: 1px solid var(--neutral-divider-rest);">Snapshots</th>
-                            <th style="padding: 8px; text-align: left; border-bottom: 1px solid var(--neutral-divider-rest);">Errors</th>
-                        </tr>
-                    </thead>
-                    <tbody>
-                        @foreach (var run in RecentRuns)
-                        {
-                            <tr>
-                                <td style="padding: 8px; border-bottom: 1px solid var(--neutral-stroke-divider-rest); font-family: monospace; font-size: 12px;">@run.RunId</td>
-                                <td style="padding: 8px; border-bottom: 1px solid var(--neutral-stroke-divider-rest);">@run.Status</td>
-                                <td style="padding: 8px; border-bottom: 1px solid var(--neutral-stroke-divider-rest); font-size: 12px;">@run.StartedAt</td>
-                                <td style="padding: 8px; border-bottom: 1px solid var(--neutral-stroke-divider-rest); font-size: 12px;">@run.FinishedAt</td>
-                                <td style="padding: 8px; border-bottom: 1px solid var(--neutral-stroke-divider-rest);">@run.TotalSnapshots</td>
-                                <td style="padding: 8px; border-bottom: 1px solid var(--neutral-stroke-divider-rest);">@run.TotalErrors</td>
-                            </tr>
-                        }
-                    </tbody>
-                </table>
-            </div>
-        </FluentCard>
+        <MudPaper Class="pa-4" Elevation="2">
+            <MudText Typo="Typo.h6" Class="mb-3">Recent Runs</MudText>
+            <MudTable Items="@RecentRuns" Dense="true" Hover="true">
+                <HeaderContent>
+                    <MudTh>Run ID</MudTh>
+                    <MudTh>Status</MudTh>
+                    <MudTh>Started</MudTh>
+                    <MudTh>Finished</MudTh>
+                    <MudTh>Snapshots</MudTh>
+                    <MudTh>Errors</MudTh>
+                </HeaderContent>
+                <RowTemplate>
+                    <MudTd DataLabel="Run ID" Style="font-family: monospace; font-size: 12px;">@context.RunId</MudTd>
+                    <MudTd DataLabel="Status">@context.Status</MudTd>
+                    <MudTd DataLabel="Started">@context.StartedAt</MudTd>
+                    <MudTd DataLabel="Finished">@context.FinishedAt</MudTd>
+                    <MudTd DataLabel="Snapshots">@context.TotalSnapshots</MudTd>
+                    <MudTd DataLabel="Errors">@context.TotalErrors</MudTd>
+                </RowTemplate>
+            </MudTable>
+        </MudPaper>
     }
 }
 
@@ -138,7 +108,6 @@ else if (DashboardState != null)
         try
         {
             DashboardState = await ApiClient.GetCollectionStateAsync();
-
             var runsResponse = await ApiClient.GetCollectionRunsAsync(10);
             RecentRuns = runsResponse?.Runs ?? new();
         }

src/dotnet/QuantEngine.Web/Client/Pages/Dashboard.razor

@@ -1,89 +1,84 @@
-@page "/"
+@page "/dashboard"
 @attribute [Authorize]
 @using QuantEngine.Core.Infrastructure
 @inject HttpClient Http
 
 <PageTitle>Quant Engine - Dashboard</PageTitle>
 
-<h1 style="margin: 0 0 8px 0; font-size: 28px; font-weight: 600;">Quant Engine</h1>
-<p style="margin: 0 0 16px 0; color: var(--neutral-foreground-2); font-size: 14px;">
-    루트 화면은 운영 진입점입니다. 가짜 성과 수치 없이 현재 스냅샷 상태와 리포트 경로만 보여줍니다.
-</p>
+<MudText Typo="Typo.h4" Class="mb-2">Quant Engine</MudText>
+<MudText Typo="Typo.body2" Class="mb-4">운영 진입점입니다. 로그인 후 현재 스냅샷 상태와 리포트 경로만 표시합니다.</MudText>
 
-<!-- Top 3 Cards -->
-<FluentStack Orientation="Orientation.Horizontal" HorizontalGap="16" Wrap="true" Style="margin-bottom: 16px;">
-    <FluentCard Style="flex: 1; min-width: 200px;">
-        <div style="padding: 16px;">
-            <p style="margin: 0 0 8px 0; color: var(--neutral-foreground-2); font-size: 12px; font-weight: 500;">Operational Report</p>
-            <h3 style="margin: 0; font-size: 20px; font-weight: 600;">@ReportStateLabel</h3>
-            <p style="margin: 8px 0 0 0; color: var(--neutral-foreground-3); font-size: 12px;">@ReportPath</p>
-        </div>
-    </FluentCard>
-    <FluentCard Style="flex: 1; min-width: 200px;">
-        <div style="padding: 16px;">
-            <p style="margin: 0 0 8px 0; color: var(--neutral-foreground-2); font-size: 12px; font-weight: 500;">Sections</p>
-            <h3 style="margin: 0; font-size: 20px; font-weight: 600;">@SectionCountLabel</h3>
-            <p style="margin: 8px 0 0 0; color: var(--neutral-foreground-3); font-size: 12px;">Temp/operational_report.json</p>
-        </div>
-    </FluentCard>
-    <FluentCard Style="flex: 1; min-width: 200px;">
-        <div style="padding: 16px;">
-            <p style="margin: 0 0 8px 0; color: var(--neutral-foreground-2); font-size: 12px; font-weight: 500;">Primary Route</p>
-            <FluentButton Appearance="ButtonAppearance.Primary" Href="/operations" Style="margin-top: 8px;">
-                Open Operations
-            </FluentButton>
-        </div>
-    </FluentCard>
-</FluentStack>
+<MudGrid Spacing="2" Class="mb-4">
+    <MudItem xs="12" sm="4">
+        <MudPaper Class="pa-4" Elevation="2">
+            <MudText Typo="Typo.caption">Operational Report</MudText>
+            <MudText Typo="Typo.h6">@ReportStateLabel</MudText>
+            <MudText Typo="Typo.body2">@ReportPath</MudText>
+        </MudPaper>
+    </MudItem>
+    <MudItem xs="12" sm="4">
+        <MudPaper Class="pa-4" Elevation="2">
+            <MudText Typo="Typo.caption">Sections</MudText>
+            <MudText Typo="Typo.h6">@SectionCountLabel</MudText>
+            <MudText Typo="Typo.body2">Temp/operational_report.json</MudText>
+        </MudPaper>
+    </MudItem>
+    <MudItem xs="12" sm="4">
+        <MudPaper Class="pa-4" Elevation="2">
+            <MudText Typo="Typo.caption">Primary Route</MudText>
+            <MudButton Variant="Variant.Filled" Color="Color.Primary" Href="/operations" Class="mt-2">Open Operations</MudButton>
+        </MudPaper>
+    </MudItem>
+</MudGrid>
 
-<!-- Current State & Routing Notes -->
-<FluentStack Orientation="Orientation.Horizontal" HorizontalGap="16" Wrap="true" Style="margin-bottom: 16px;">
-    <FluentCard Style="flex: 2; min-width: 300px;">
-        <div style="padding: 16px;">
-            <h3 style="margin: 0 0 12px 0; font-size: 16px; font-weight: 600;">Current State</h3>
-            <FluentStack Orientation="Orientation.Vertical" VerticalGap="8">
-                <p style="margin: 0; font-size: 14px;"><strong>Status:</strong> <FluentBadge Appearance="BadgeAppearance.Filled">@ReportChipLabel</FluentBadge></p>
-                <p style="margin: 0; font-size: 14px;"><strong>Generated:</strong> @GeneratedAtLabel</p>
-                <p style="margin: 0; font-size: 14px;"><strong>Source:</strong> @SourceLabel</p>
-                <p style="margin: 0; font-size: 14px;"><strong>Decision feed:</strong> @DecisionFeedLabel</p>
-                <p style="margin: 0; font-size: 14px;"><strong>Factor feed:</strong> @FactorFeedLabel</p>
-                <p style="margin: 0; font-size: 14px;"><strong>Raw feed:</strong> @RawFeedLabel</p>
-            </FluentStack>
-        </div>
-    </FluentCard>
-
-    <FluentCard Style="flex: 1; min-width: 250px;">
-        <div style="padding: 16px;">
-            <h3 style="margin: 0 0 12px 0; font-size: 16px; font-weight: 600;">Routing Notes</h3>
-            <ul style="margin: 0; padding-left: 16px; font-size: 14px;">
+<MudGrid Spacing="2" Class="mb-4">
+    <MudItem xs="12" md="8">
+        <MudPaper Class="pa-4" Elevation="2">
+            <MudText Typo="Typo.h6" Class="mb-3">Current State</MudText>
+            <MudStack Spacing="1">
+                <MudText Typo="Typo.body2">Status: <MudChip T="string" Color="@(ReportChipLabel == "READY" ? Color.Success : Color.Warning)" Variant="Variant.Filled">@ReportChipLabel</MudChip></MudText>
+                <MudText Typo="Typo.body2">Generated: @GeneratedAtLabel</MudText>
+                <MudText Typo="Typo.body2">Source: @SourceLabel</MudText>
+                <MudText Typo="Typo.body2">Decision feed: @DecisionFeedLabel</MudText>
+                <MudText Typo="Typo.body2">Factor feed: @FactorFeedLabel</MudText>
+                <MudText Typo="Typo.body2">Raw feed: @RawFeedLabel</MudText>
+            </MudStack>
+        </MudPaper>
+    </MudItem>
+    <MudItem xs="12" md="4">
+        <MudPaper Class="pa-4" Elevation="2">
+            <MudText Typo="Typo.h6" Class="mb-3">Routing Notes</MudText>
+            <ul style="margin: 0; padding-left: 18px;">
                 <li>운영 데이터는 snapshot 우선입니다.</li>
-                <li>Excel/GAS 의존 문구는 운영 경로에서 제거 대상입니다.</li>
+                <li>Excel/GAS 의존 문구는 제거 대상입니다.</li>
                 <li>숫자는 provenance 없으면 표시하지 않습니다.</li>
             </ul>
-        </div>
-    </FluentCard>
-</FluentStack>
+        </MudPaper>
+    </MudItem>
+</MudGrid>
 
-<!-- Coverage Summary -->
-<FluentCard>
-    <div style="padding: 16px;">
-        <h3 style="margin: 0 0 12px 0; font-size: 16px; font-weight: 600;">Coverage Summary</h3>
-        @if (Sections.Count == 0)
-        {
-            <div style="padding: 12px; background: var(--warning-background-1); border: 1px solid var(--warning-stroke-1); border-radius: 4px; color: var(--warning-foreground-1); font-size: 14px;">
-                DATA_MISSING: operational_report.json이 비어 있거나 아직 생성되지 않았습니다.
-            </div>
-        }
-        else
-        {
-            <FluentDataGrid Items="@Sections.AsQueryable()">
-                <PropertyColumn Property="@(x => x.Name)" Title="Name" />
-                <PropertyColumn Property="@(x => x.Title)" Title="Title" />
-                <PropertyColumn Property="@(x => x.Preview)" Title="Preview" />
-            </FluentDataGrid>
-        }
-    </div>
-</FluentCard>
+<MudPaper Class="pa-4" Elevation="2">
+    <MudText Typo="Typo.h6" Class="mb-3">Coverage Summary</MudText>
+    @if (Sections.Count == 0)
+    {
+        <MudAlert Severity="Severity.Warning">DATA_MISSING: operational_report.json이 비어 있거나 아직 생성되지 않았습니다.</MudAlert>
+    }
+    else
+    {
+        <MudTable Items="@Sections" Dense="true" Hover="true">
+            <HeaderContent>
+                <MudTh>Name</MudTh>
+                <MudTh>Title</MudTh>
+                <MudTh>Preview</MudTh>
+            </HeaderContent>
+            <RowTemplate>
+                <MudTd DataLabel="Name">@context.Name</MudTd>
+                <MudTd DataLabel="Title">@context.Title</MudTd>
+                <MudTd DataLabel="Preview">@context.Preview</MudTd>
+            </RowTemplate>
+        </MudTable>
+    }
+</MudPaper>
 
 @code {
     private readonly List<OperationalReportSection> Sections = new();

src/dotnet/QuantEngine.Web/Client/Pages/Login.razor

@@ -1,264 +1,55 @@
 @page "/login"
 @attribute [AllowAnonymous]
+@layout AuthLayout
 @inject AuthenticationStateProvider AuthStateProvider
 @inject NavigationManager NavigationManager
 @inject HttpClient Http
 
 <PageTitle>로그인 - QuantEngine</PageTitle>
 
-<div class="auth-container">
-    <div class="auth-card">
-        <div class="brand-section">
-            <img src="images/quant_engine_logo.jpg" alt="QuantEngine Logo" class="brand-logo" />
-            <h1 class="brand-title">QuantEngine</h1>
-            <p class="brand-subtitle">은퇴자산포트폴리오 투자 관리 시스템</p>
-        </div>
+<MudContainer MaxWidth="MaxWidth.False" Class="login-shell">
+    <MudPaper Class="login-card pa-8" Elevation="10">
+        <MudStack AlignItems="AlignItems.Center" Spacing="2" Class="mb-6">
+            <MudAvatar Size="Size.Large" Color="Color.Primary">Q</MudAvatar>
+            <MudText Typo="Typo.h4">QuantEngine</MudText>
+            <MudText Typo="Typo.body2" Align="Align.Center">은퇴자산포트폴리오 투자 관리 시스템</MudText>
+        </MudStack>
 
-        <form @onsubmit="HandleLoginAsync" class="auth-form">
-            <div class="form-group">
-                <label for="username">관리자 아이디</label>
-                <input type="text" id="username" class="form-control" @bind="Username" placeholder="아이디를 입력하세요" autocomplete="username" />
-            </div>
-
-            <div class="form-group">
-                <label for="password">비밀번호</label>
-                <input type="password" id="password" class="form-control" @bind="Password" placeholder="비밀번호를 입력하세요" autocomplete="current-password" />
-            </div>
+        <MudStack Spacing="2">
+            <MudTextField Label="관리자 아이디" @bind-Value="Username" Variant="Variant.Outlined" Immediate="true" AutoFocus="true" />
+            <MudTextField Label="비밀번호" @bind-Value="Password" Variant="Variant.Outlined" InputType="InputType.Password" Immediate="true" />
+            <MudCheckBox T="bool" @bind-Checked="RememberUsername" Color="Color.Primary" Label="아이디 저장" />
 
             @if (!string.IsNullOrEmpty(ErrorMessage))
             {
-                <div class="error-message">
-                    <svg class="error-icon" fill="none" viewBox="0 0 24 24" stroke="currentColor">
-                        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" />
-                    </svg>
-                    <span>@ErrorMessage</span>
-                </div>
+                <MudAlert Severity="Severity.Error">@ErrorMessage</MudAlert>
             }
 
-            <button type="submit" class="btn-submit" disabled="@IsSubmitting">
-                @if (IsSubmitting)
-                {
-                    <span class="spinner"></span>
-                    <span>인증 중...</span>
-                }
-                else
-                {
-                    <span>로그인</span>
-                }
-            </button>
-        </form>
-    </div>
-</div>
+            <MudButton Variant="Variant.Filled" Color="Color.Primary" FullWidth="true" Disabled="@IsSubmitting" OnClick="HandleLoginAsync">
+                @(IsSubmitting ? "인증 중..." : "로그인")
+            </MudButton>
+        </MudStack>
+    </MudPaper>
+</MudContainer>
 
 <style>
-    .auth-container {
-        display: flex;
-        align-items: center;
-        justify-content: center;
+    .login-shell {
         min-height: 100vh;
-        width: 100vw;
-        background: linear-gradient(135deg, #090a15 0%, #12142d 100%);
-        font-family: 'Roboto', 'Inter', sans-serif;
-        color: #ffffff;
-        position: fixed;
-        top: 0;
-        left: 0;
-        z-index: 9999;
-        overflow: hidden;
-    }
-
-    /* Ambient background glow */
-    .auth-container::before {
-        content: "";
-        position: absolute;
-        width: 600px;
-        height: 600px;
-        background: radial-gradient(circle, rgba(0, 242, 254, 0.08) 0%, rgba(79, 172, 254, 0) 70%);
-        top: -10%;
-        left: -10%;
-        pointer-events: none;
-    }
-
-    .auth-container::after {
-        content: "";
-        position: absolute;
-        width: 600px;
-        height: 600px;
-        background: radial-gradient(circle, rgba(79, 172, 254, 0.08) 0%, rgba(0, 242, 254, 0) 70%);
-        bottom: -10%;
-        right: -10%;
-        pointer-events: none;
-    }
-
-    .auth-card {
-        background: rgba(255, 255, 255, 0.02);
-        backdrop-filter: blur(25px);
-        -webkit-backdrop-filter: blur(25px);
-        border: 1px solid rgba(255, 255, 255, 0.06);
-        border-radius: 20px;
-        padding: 48px;
-        width: 440px;
-        box-shadow: 0 20px 50px rgba(0, 0, 0, 0.4);
-        display: flex;
-        flex-direction: column;
-        align-items: center;
-        z-index: 10;
-        animation: fadeIn 0.8s cubic-bezier(0.16, 1, 0.3, 1);
-    }
-
-    .brand-section {
-        text-align: center;
-        margin-bottom: 36px;
-        display: flex;
-        flex-direction: column;
-        align-items: center;
-    }
-
-    .brand-logo {
-        width: 80px;
-        height: 80px;
-        border-radius: 50%;
-        object-fit: cover;
-        border: 2px solid rgba(0, 242, 254, 0.3);
-        box-shadow: 0 0 20px rgba(0, 242, 254, 0.15);
-        margin-bottom: 16px;
-        transition: transform 0.3s ease;
-    }
-
-    .brand-logo:hover {
-        transform: rotate(5deg) scale(1.05);
-    }
-
-    .brand-title {
-        font-size: 26px;
-        font-weight: 700;
-        margin: 0;
-        background: linear-gradient(90deg, #00f2fe 0%, #4facfe 100%);
-        -webkit-background-clip: text;
-        -webkit-text-fill-color: transparent;
-        letter-spacing: 0.5px;
-    }
-
-    .brand-subtitle {
-        font-size: 13px;
-        color: rgba(255, 255, 255, 0.5);
-        margin: 6px 0 0 0;
-        font-weight: 300;
-    }
-
-    .auth-form {
-        width: 100%;
-        display: flex;
-        flex-direction: column;
-        gap: 20px;
-    }
-
-    .form-group {
-        display: flex;
-        flex-direction: column;
-        gap: 8px;
-    }
-
-    .form-group label {
-        font-size: 13px;
-        font-weight: 500;
-        color: rgba(255, 255, 255, 0.8);
-        padding-left: 2px;
-    }
-
-    .form-control {
-        background: rgba(255, 255, 255, 0.04);
-        border: 1px solid rgba(255, 255, 255, 0.1);
-        border-radius: 10px;
-        padding: 14px 16px;
-        color: #ffffff;
-        font-size: 14px;
-        transition: all 0.3s ease;
-        outline: none;
-    }
-
-    .form-control:focus {
-        border-color: rgba(0, 242, 254, 0.6);
-        background: rgba(255, 255, 255, 0.08);
-        box-shadow: 0 0 12px rgba(0, 242, 254, 0.15);
-    }
-
-    .form-control::placeholder {
-        color: rgba(255, 255, 255, 0.25);
-    }
-
-    .error-message {
-        display: flex;
-        align-items: center;
-        gap: 10px;
-        background: rgba(239, 68, 68, 0.08);
-        border: 1px solid rgba(239, 68, 68, 0.2);
-        border-radius: 10px;
-        padding: 12px 16px;
-        color: #f87171;
-        font-size: 13px;
-    }
-
-    .error-icon {
-        width: 18px;
-        height: 18px;
-        flex-shrink: 0;
-    }
-
-    .btn-submit {
-        background: linear-gradient(90deg, #00f2fe 0%, #4facfe 100%);
-        border: none;
-        border-radius: 10px;
-        padding: 14px;
-        color: #0b0c15;
-        font-size: 15px;
-        font-weight: 700;
-        cursor: pointer;
         display: flex;
         align-items: center;
         justify-content: center;
-        gap: 10px;
-        transition: all 0.3s ease;
-        box-shadow: 0 4px 15px rgba(0, 242, 254, 0.2);
+        background:
+            radial-gradient(circle at top left, rgba(0, 242, 254, 0.08), transparent 30%),
+            radial-gradient(circle at bottom right, rgba(79, 172, 254, 0.1), transparent 35%),
+            linear-gradient(135deg, #090a15 0%, #12142d 100%);
     }
 
-    .btn-submit:hover:not(:disabled) {
-        transform: translateY(-2px);
-        box-shadow: 0 6px 20px rgba(0, 242, 254, 0.35);
-    }
-
-    .btn-submit:active:not(:disabled) {
-        transform: translateY(0);
-    }
-
-    .btn-submit:disabled {
-        opacity: 0.6;
-        cursor: not-allowed;
-        box-shadow: none;
-    }
-
-    .spinner {
-        width: 16px;
-        height: 16px;
-        border: 2px solid rgba(11, 12, 21, 0.25);
-        border-top-color: #0b0c15;
-        border-radius: 50%;
-        animation: spin 0.8s linear infinite;
-    }
-
-    @@keyframes spin {
-        to { transform: rotate(360deg); }
-    }
-
-    @@keyframes fadeIn {
-        from {
-            opacity: 0;
-            transform: translateY(20px);
-        }
-        to {
-            opacity: 1;
-            transform: translateY(0);
-        }
+    .login-card {
+        width: min(480px, calc(100vw - 32px));
+        border-radius: 20px;
+        background: rgba(255, 255, 255, 0.04);
+        backdrop-filter: blur(24px);
+        color: white;
     }
 </style>
 
@@ -267,6 +58,27 @@
     private string Password { get; set; } = string.Empty;
     private string ErrorMessage { get; set; } = string.Empty;
     private bool IsSubmitting { get; set; } = false;
+    private bool RememberUsername { get; set; } = true;
+
+    protected override async Task OnInitializedAsync()
+    {
+        var customProvider = (CustomAuthenticationStateProvider)AuthStateProvider;
+        var remembered = await customProvider.GetRememberedUsernameAsync();
+        if (!string.IsNullOrWhiteSpace(remembered))
+        {
+            Username = remembered;
+            RememberUsername = true;
+        }
+    }
+
+    private sealed class LoginResponse
+    {
+        public bool Success { get; set; }
+        public string? Username { get; set; }
+        public string? Role { get; set; }
+        public string? AccessToken { get; set; }
+        public string? ExpiresAt { get; set; }
+    }
 
     private async Task HandleLoginAsync()
     {
@@ -282,14 +94,18 @@
         try
         {
             var response = await Http.PostAsJsonAsync("api/auth/login", new { Username, Password });
-
             if (response.IsSuccessStatusCode)
             {
-                var customProvider = (CustomAuthenticationStateProvider)AuthStateProvider;
-                await customProvider.MarkUserAsAuthenticatedAsync(Username);
+                var auth = await response.Content.ReadFromJsonAsync<LoginResponse>();
+                if (auth is null || string.IsNullOrWhiteSpace(auth.AccessToken))
+                {
+                    ErrorMessage = "로그인 응답이 유효하지 않습니다.";
+                    return;
+                }
 
-                // Redirect back to home dashboard
-                NavigationManager.NavigateTo("");
+                var customProvider = (CustomAuthenticationStateProvider)AuthStateProvider;
+                await customProvider.MarkUserAsAuthenticatedAsync(auth.Username ?? Username, auth.AccessToken, auth.Role ?? "Admin", RememberUsername);
+                NavigationManager.NavigateTo("/dashboard");
             }
             else
             {

src/dotnet/QuantEngine.Web/Client/Pages/Operations.razor

@@ -3,87 +3,82 @@
 @using QuantEngine.Core.Infrastructure
 @inject HttpClient Http
 
-<PageTitle>Quant Engine - Operations</PageTitle>
+<PageTitle>QuantEngine - Operations</PageTitle>
 
-<h1 style="margin: 0 0 8px 0; font-size: 28px; font-weight: 600;">Operational Report</h1>
-<p style="margin: 0 0 16px 0; color: var(--neutral-foreground-2); font-size: 14px;">
-    이 페이지는 `Temp/operational_report.json`만 읽습니다. DB 연결과 무관하게 동일한 결과를 보여주는 운영 고정 화면입니다.
-</p>
+<MudText Typo="Typo.h4" Class="mb-2">Operational Report</MudText>
+<MudText Typo="Typo.body2" Class="mb-4">Temp/operational_report.json만 읽는 운영 고정 화면입니다.</MudText>
 
-<!-- Metadata Cards -->
-<FluentStack Orientation="Orientation.Horizontal" HorizontalGap="16" Wrap="true" Style="margin-bottom: 16px;">
-    <FluentCard Style="flex: 1; min-width: 150px;">
-        <div style="padding: 16px;">
-            <p style="margin: 0 0 8px 0; color: var(--neutral-foreground-2); font-size: 12px; font-weight: 500;">Schema</p>
-            <h3 style="margin: 0; font-size: 18px; font-weight: 600;">@SchemaVersion</h3>
-        </div>
-    </FluentCard>
-    <FluentCard Style="flex: 1; min-width: 150px;">
-        <div style="padding: 16px;">
-            <p style="margin: 0 0 8px 0; color: var(--neutral-foreground-2); font-size: 12px; font-weight: 500;">Sections</p>
-            <h3 style="margin: 0; font-size: 18px; font-weight: 600;">@SectionCountLabel</h3>
-        </div>
-    </FluentCard>
-    <FluentCard Style="flex: 1; min-width: 150px;">
-        <div style="padding: 16px;">
-            <p style="margin: 0 0 8px 0; color: var(--neutral-foreground-2); font-size: 12px; font-weight: 500;">Source</p>
-            <h3 style="margin: 0; font-size: 18px; font-weight: 600;">@SourceJson</h3>
-        </div>
-    </FluentCard>
-    <FluentCard Style="flex: 1; min-width: 150px;">
-        <div style="padding: 16px;">
-            <p style="margin: 0 0 8px 0; color: var(--neutral-foreground-2); font-size: 12px; font-weight: 500;">Generated</p>
-            <h3 style="margin: 0; font-size: 18px; font-weight: 600;">@GeneratedAt</h3>
-        </div>
-    </FluentCard>
-</FluentStack>
+<MudGrid Spacing="2" Class="mb-4">
+    <MudItem xs="12" sm="3">
+        <MudPaper Class="pa-4" Elevation="2">
+            <MudText Typo="Typo.caption">Schema</MudText>
+            <MudText Typo="Typo.h6">@SchemaVersion</MudText>
+        </MudPaper>
+    </MudItem>
+    <MudItem xs="12" sm="3">
+        <MudPaper Class="pa-4" Elevation="2">
+            <MudText Typo="Typo.caption">Sections</MudText>
+            <MudText Typo="Typo.h6">@SectionCountLabel</MudText>
+        </MudPaper>
+    </MudItem>
+    <MudItem xs="12" sm="3">
+        <MudPaper Class="pa-4" Elevation="2">
+            <MudText Typo="Typo.caption">Source</MudText>
+            <MudText Typo="Typo.h6">@SourceJson</MudText>
+        </MudPaper>
+    </MudItem>
+    <MudItem xs="12" sm="3">
+        <MudPaper Class="pa-4" Elevation="2">
+            <MudText Typo="Typo.caption">Generated</MudText>
+            <MudText Typo="Typo.h6">@GeneratedAt</MudText>
+        </MudPaper>
+    </MudItem>
+</MudGrid>
 
-<!-- Highlight Sections Grid -->
-<FluentStack Orientation="Orientation.Horizontal" HorizontalGap="16" Wrap="true" Style="margin-bottom: 16px;">
+<MudGrid Spacing="2" Class="mb-4">
     @foreach (var section in HighlightSections)
     {
-        <FluentCard Style="flex: 1; min-width: 200px;">
-            <div style="padding: 16px;">
-                <p style="margin: 0 0 4px 0; color: var(--neutral-foreground-2); font-size: 12px;">@(section.Name)</p>
-                <h3 style="margin: 4px 0; font-size: 16px; font-weight: 600;">@(section.Title)</h3>
-                <p style="margin: 8px 0 0 0; color: var(--neutral-foreground-3); font-size: 12px;">@(section.Preview)</p>
-            </div>
-        </FluentCard>
+        <MudItem xs="12" sm="6" md="3" @key="section.Name">
+            <MudPaper Class="pa-4" Elevation="2">
+                <MudText Typo="Typo.caption">@(section.Name)</MudText>
+                <MudText Typo="Typo.h6">@(section.Title)</MudText>
+                <MudText Typo="Typo.body2">@(section.Preview)</MudText>
+            </MudPaper>
+        </MudItem>
     }
-</FluentStack>
+</MudGrid>
 
-<!-- Report Health -->
-<FluentCard Style="margin-bottom: 16px;">
-    <div style="padding: 16px;">
-        <h3 style="margin: 0 0 12px 0; font-size: 16px; font-weight: 600;">Report Health</h3>
-        <FluentStack Orientation="Orientation.Vertical" VerticalGap="8">
-            <p style="margin: 0; font-size: 14px;"><strong>Status:</strong> <FluentBadge Appearance="BadgeAppearance.Filled">@HealthLabel</FluentBadge></p>
-            <p style="margin: 0; font-size: 14px;"><strong>Path:</strong> @ReportPath</p>
-            <p style="margin: 0; font-size: 14px;"><strong>Sections rendered:</strong> @RenderedSectionCountLabel</p>
-        </FluentStack>
-    </div>
-</FluentCard>
+<MudPaper Class="pa-4 mb-4" Elevation="2">
+    <MudText Typo="Typo.h6" Class="mb-3">Report Health</MudText>
+    <MudStack Spacing="1">
+        <MudText Typo="Typo.body2">Status: <MudChip T="string" Color="@(HealthLabel == "PASS" ? Color.Success : Color.Warning)" Variant="Variant.Filled">@HealthLabel</MudChip></MudText>
+        <MudText Typo="Typo.body2">Path: @ReportPath</MudText>
+        <MudText Typo="Typo.body2">Sections rendered: @RenderedSectionCountLabel</MudText>
+    </MudStack>
+</MudPaper>
 
-<!-- Sections Table -->
-<FluentCard>
-    <div style="padding: 16px;">
-        <h3 style="margin: 0 0 12px 0; font-size: 16px; font-weight: 600;">Sections</h3>
-        @if (Sections.Count == 0)
-        {
-            <div style="padding: 12px; background: var(--warning-background-1); border: 1px solid var(--warning-stroke-1); border-radius: 4px; color: var(--warning-foreground-1); font-size: 14px;">
-                DATA_MISSING: operational_report.json에 표시할 섹션이 없습니다.
-            </div>
-        }
-        else
-        {
-            <FluentDataGrid Items="@Sections.AsQueryable()">
-                <PropertyColumn Property="@(x => x.Name)" Title="Name" />
-                <PropertyColumn Property="@(x => x.Title)" Title="Title" />
-                <PropertyColumn Property="@(x => x.Preview)" Title="Preview" />
-            </FluentDataGrid>
-        }
-    </div>
-</FluentCard>
+<MudPaper Class="pa-4" Elevation="2">
+    <MudText Typo="Typo.h6" Class="mb-3">Sections</MudText>
+    @if (Sections.Count == 0)
+    {
+        <MudAlert Severity="Severity.Warning">DATA_MISSING: operational_report.json에 표시할 섹션이 없습니다.</MudAlert>
+    }
+    else
+    {
+        <MudTable Items="@Sections" Dense="true" Hover="true">
+            <HeaderContent>
+                <MudTh>Name</MudTh>
+                <MudTh>Title</MudTh>
+                <MudTh>Preview</MudTh>
+            </HeaderContent>
+            <RowTemplate>
+                <MudTd DataLabel="Name">@context.Name</MudTd>
+                <MudTd DataLabel="Title">@context.Title</MudTd>
+                <MudTd DataLabel="Preview">@context.Preview</MudTd>
+            </RowTemplate>
+        </MudTable>
+    }
+</MudPaper>
 
 @code {
     private readonly List<OperationalReportSection> Sections = new();

src/dotnet/QuantEngine.Web/Client/Program.cs

@@ -1,14 +1,10 @@
 using Microsoft.AspNetCore.Components.WebAssembly.Hosting;
-using Microsoft.FluentUI.AspNetCore.Components;
 using Microsoft.AspNetCore.Components.Authorization;
 using QuantEngine.Web.Client.Services;
 using QuantEngine.Web.Client.Infrastructure;
 
 var builder = WebAssemblyHostBuilder.CreateDefault(args);
 
-// Register Fluent UI
-builder.Services.AddFluentUIComponents();
-
 // Register LocalStorage for cross-platform session persistence
 builder.Services.AddScoped<LocalStorageService>();
 

src/dotnet/QuantEngine.Web/Client/QuantEngine.Web.Client.csproj

@@ -16,8 +16,7 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly" Version="10.0.0-preview.2.25120.18" />
     <PackageReference Include="Microsoft.AspNetCore.Components.Authorization" Version="10.0.0-preview.2.25120.18" />
-    <PackageReference Include="Microsoft.FluentUI.AspNetCore.Components" Version="5.0.0-rc.4-26177.1" />
-    <PackageReference Include="Microsoft.FluentUI.AspNetCore.Components.Icons" Version="5.0.0-rc.4-26177.1" />
+    <PackageReference Include="MudBlazor" Version="8.6.0" />
   </ItemGroup>
 
 </Project>

src/dotnet/QuantEngine.Web/Client/_Imports.razor

@@ -6,8 +6,7 @@
 @using static Microsoft.AspNetCore.Components.Web.RenderMode
 @using Microsoft.AspNetCore.Components.Web.Virtualization
 @using Microsoft.JSInterop
-@using Microsoft.FluentUI.AspNetCore.Components
-@using Microsoft.FluentUI.AspNetCore.Components.Icons
+@using MudBlazor
 @using QuantEngine.Web.Client
 @using QuantEngine.Web.Client.Pages
 @using QuantEngine.Web.Client.Layout

src/dotnet/QuantEngine.Web/Components/App.razor

@@ -1,29 +1,29 @@
 <!DOCTYPE html>
-<html lang="en">
+<html lang="ko">
 
 <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <base href="/quant/" />
+    <base href="/" />
     <ResourcePreloader />
-    <!-- Fluent UI CSS -->
     <link href="https://fonts.googleapis.com/css?family=Roboto:300,400,500,700&display=swap" rel="stylesheet" />
-    <link href="_content/Microsoft.FluentUI.AspNetCore.Components/css/fluent-components.css" rel="stylesheet" />
+    <link href="_content/MudBlazor/MudBlazor.min.css" rel="stylesheet" />
     <link rel="stylesheet" href="@Assets["app.css"]" />
     <link rel="stylesheet" href="@Assets["QuantEngine.Web.styles.css"]" />
     <ImportMap />
-    <link rel="icon" type="image/png" href="favicon.png" />
+    <link rel="icon" type="image/svg+xml" href="favicon.svg" />
+    <link rel="alternate icon" type="image/png" href="favicon.png" />
     <HeadOutlet @rendermode="InteractiveWebAssembly" />
 </head>
 
 <body>
-    <FluentDesignSystemProvider>
-        <Routes @rendermode="InteractiveWebAssembly" />
-        <ReconnectModal />
-    </FluentDesignSystemProvider>
+    <MudThemeProvider />
+    <MudDialogProvider />
+    <MudSnackbarProvider />
+    <Routes @rendermode="InteractiveWebAssembly" />
+    <ReconnectModal />
 
-    <!-- Fluent UI JS -->
-    <script src="_content/Microsoft.FluentUI.AspNetCore.Components/js/fluent-components.js"></script>
+    <script src="_content/MudBlazor/MudBlazor.min.js"></script>
     <script src="@Assets["_framework/blazor.web.js"]"></script>
 </body>
 

src/dotnet/QuantEngine.Web/Components/_Imports.razor

@@ -6,8 +6,7 @@
 @using static Microsoft.AspNetCore.Components.Web.RenderMode
 @using Microsoft.AspNetCore.Components.Web.Virtualization
 @using Microsoft.JSInterop
-@using Microsoft.FluentUI.AspNetCore.Components
-@using Microsoft.FluentUI.AspNetCore.Components.Icons
+@using MudBlazor
 @using QuantEngine.Web
 @using QuantEngine.Web.Components
 @using QuantEngine.Web.Components.Layout

src/dotnet/QuantEngine.Web/Program.cs

@@ -8,11 +8,17 @@ using QuantEngine.Core.Interfaces;
 using QuantEngine.Application.Services;
 using System.Text.Json;
 using static QuantEngine.Application.Services.DataCollectionService;
-using Microsoft.FluentUI.AspNetCore.Components;
 using Serilog;
 using QuantEngine.Web.Client.Infrastructure;
 using QuantEngine.Web.Client.Services;
 using QuantEngine.Web.Endpoints;
+using System.Security.Cryptography;
+using System.Text;
+using QuantEngine.Core.Models;
+using Microsoft.AspNetCore.Authentication;
+using System.Text.Encodings.Web;
+using Microsoft.Extensions.Options;
+using MudBlazor.Services;
 
 // Serilog Configuration with Telegram Sink
 Log.Logger = new LoggerConfiguration()
@@ -30,17 +36,28 @@ builder.Services.AddRazorComponents()
 
 // Authentication and Custom State Provider (Shared client components)
 builder.Services.AddCascadingAuthenticationState();
+builder.Services.AddAuthentication("QuantAdminScheme")
+    .AddScheme<AuthenticationSchemeOptions, QuantAdminAuthHandler>("QuantAdminScheme", _ => { });
+builder.Services.AddAuthorization();
 builder.Services.AddScoped<LocalStorageService>();
 builder.Services.AddScoped<AuthenticationStateProvider, CustomAuthenticationStateProvider>();
 builder.Services.AddAuthorizationCore();
 
-// Fluent UI Services
-builder.Services.AddFluentUIComponents();
+builder.Services.AddMudServices();
 
 // PostgreSQL Dapper Setup
-var connectionString = builder.Configuration.GetConnectionString("DefaultConnection")
-    ?? "Host=127.0.0.1;Database=giteadb;Username=gitea;Password=C8RFlZ9fdQrBA1vyLhLDS4v70I8dJfRS2ERJW4+zsS4=;Search Path=quantengine;";
+var configuredConnectionString = builder.Configuration.GetConnectionString("DefaultConnection");
+var fallbackConnectionString = "Host=127.0.0.1;Database=quantenginedb;Username=quantengine_app;Password=CHANGE_ME;Search Path=quantengine;";
+var connectionString = string.IsNullOrWhiteSpace(configuredConnectionString) || configuredConnectionString.Contains("Password=;", StringComparison.OrdinalIgnoreCase)
+    ? fallbackConnectionString
+    : configuredConnectionString;
+var configuredDatabase = new Npgsql.NpgsqlConnectionStringBuilder(connectionString).Database;
+if (!string.Equals(configuredDatabase, "quantenginedb", StringComparison.OrdinalIgnoreCase))
+{
+    throw new InvalidOperationException("QuantEngine must use the quantenginedb PostgreSQL database.");
+}
 builder.Services.AddSingleton<IDbConnectionFactory>(new DbConnectionFactory(connectionString));
+builder.Services.AddSingleton<DbMigrator>();
 builder.Services.AddScoped<IWorkspaceRepository, WorkspaceRepository>();
 builder.Services.AddScoped<IPostgresqlHistoryStore, PostgresqlHistoryStore>();
 builder.Services.AddScoped<IPostgresqlHistorySnapshotReader, PostgresqlHistorySnapshotReader>();
@@ -57,18 +74,25 @@ builder.Services.AddHttpClient<ApiClient>();
 builder.Services.AddScoped<ApiClient>();
 
 var app = builder.Build();
+var adminSettings = app.Configuration.GetSection("AdminSettings");
+var adminUsername = adminSettings["Username"] ?? "admin";
+var adminPassword = adminSettings["Password"] ?? string.Empty;
 
 // Initialize database tables (PostgreSQL-backed repositories)
 using (var scope = app.Services.CreateScope())
 {
+    var migrator = scope.ServiceProvider.GetRequiredService<DbMigrator>();
     var tokenCache = scope.ServiceProvider.GetRequiredService<ITokenCache>();
     var collectionRepo = scope.ServiceProvider.GetRequiredService<ICollectionRepository>();
+    var workspaceRepo = scope.ServiceProvider.GetRequiredService<IWorkspaceRepository>();
 
     try
     {
+        migrator.Migrate();
         // Ensure tables exist on startup
         await tokenCache.GetCachedTokenAsync("_init_test_");
         await collectionRepo.GetDashboardStateAsync();
+        await workspaceRepo.GetAccountsAsync();
         Log.Information("Database tables initialized successfully");
     }
     catch (Exception ex)
@@ -77,9 +101,6 @@ using (var scope = app.Services.CreateScope())
     }
 }
 
-// Enable reverse proxy subpath mapping
-app.UsePathBase("/quant");
-
 // Configure the HTTP request pipeline.
 if (!app.Environment.IsDevelopment())
 {
@@ -96,25 +117,173 @@ app.UseStatusCodePages(async ctx =>
 app.UseHttpsRedirection();
 
 app.UseAntiforgery();
+app.UseAuthentication();
+app.UseAuthorization();
 
 app.MapStaticAssets();
 
+app.MapGet("/", () => Results.Redirect("/login"));
+
 // Collection API Endpoints (must be before MapRazorComponents)
 app.MapCollectionEndpoints();
 
 // Login API (API-First for Blazor WASM client authentication)
-app.MapPost("/api/auth/login", (LoginRequest request, IConfiguration config) =>
+app.MapPost("/api/auth/login", async (JsonElement payload, IWorkspaceRepository workspaceRepo) =>
 {
-    var expectedUser = config["AdminSettings:Username"] ?? "admin";
-    var expectedPass = config["AdminSettings:Password"] ?? "quant123!";
-    
-    if (request.Username == expectedUser && request.Password == expectedPass)
+    static string? ReadString(JsonElement root, params string[] names)
     {
-        return Results.Ok(new { success = true, username = request.Username });
+        foreach (var name in names)
+        {
+            if (root.ValueKind == JsonValueKind.Object && root.TryGetProperty(name, out var property) && property.ValueKind == JsonValueKind.String)
+            {
+                return property.GetString();
+            }
+        }
+
+        return null;
     }
-    return Results.Json(new { success = false, error = "invalid_credentials" }, statusCode: 401);
+
+    var username = ReadString(payload, "Username", "username");
+    var password = ReadString(payload, "Password", "password");
+
+    if (string.IsNullOrWhiteSpace(username) || string.IsNullOrWhiteSpace(password))
+    {
+        return Results.BadRequest(new { success = false, error = "missing_credentials" });
+    }
+
+    var account = await workspaceRepo.GetAccountByUsernameAsync(username.Trim());
+    if (account is null || !string.Equals(account.IsActive, "true", StringComparison.OrdinalIgnoreCase))
+    {
+        return Results.Json(new { success = false, error = "invalid_credentials" }, statusCode: 401);
+    }
+
+    var passwordHash = Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(password)));
+    if (!string.Equals(account.PasswordHash, passwordHash, StringComparison.OrdinalIgnoreCase))
+    {
+        return Results.Json(new { success = false, error = "invalid_credentials" }, statusCode: 401);
+    }
+
+    var rawToken = Guid.NewGuid().ToString("N");
+    var tokenHash = Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(rawToken)));
+    var now = DateTimeOffset.UtcNow;
+    var expiresAt = now.AddDays(7);
+
+    await workspaceRepo.UpsertSessionAsync(new WorkspaceSession
+    {
+        SessionTokenHash = tokenHash,
+        Username = account.Username,
+        Role = account.Role,
+        CreatedAt = now.ToString("O"),
+        ExpiresAt = expiresAt.ToString("O"),
+        RevokedAt = null
+    });
+
+    return Results.Ok(new
+    {
+        success = true,
+        username = account.Username,
+        role = account.Role,
+        accessToken = rawToken,
+        expiresAt = expiresAt.ToString("O")
+    });
+}).DisableAntiforgery();
+
+app.MapGet("/api/auth/me", async (HttpContext context, IWorkspaceRepository workspaceRepo) =>
+{
+    var authHeader = context.Request.Headers.Authorization.ToString();
+    if (string.IsNullOrWhiteSpace(authHeader) || !authHeader.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase))
+    {
+        return Results.Unauthorized();
+    }
+
+    var token = authHeader["Bearer ".Length..].Trim();
+    if (string.IsNullOrWhiteSpace(token))
+    {
+        return Results.Unauthorized();
+    }
+
+    var tokenHash = Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(token)));
+    var session = await workspaceRepo.GetSessionByTokenHashAsync(tokenHash);
+    if (session is null || !string.IsNullOrWhiteSpace(session.RevokedAt) || DateTimeOffset.TryParse(session.ExpiresAt, out var expiresAt) && expiresAt <= DateTimeOffset.UtcNow)
+    {
+        return Results.Unauthorized();
+    }
+
+    return Results.Ok(new { authenticated = true, username = session.Username, role = session.Role });
 });
 
+app.MapPost("/api/auth/logout", async (HttpContext context, IWorkspaceRepository workspaceRepo) =>
+{
+    var authHeader = context.Request.Headers.Authorization.ToString();
+    if (string.IsNullOrWhiteSpace(authHeader) || !authHeader.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase))
+    {
+        return Results.Unauthorized();
+    }
+
+    var token = authHeader["Bearer ".Length..].Trim();
+    if (string.IsNullOrWhiteSpace(token))
+    {
+        return Results.Unauthorized();
+    }
+
+    var tokenHash = Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(token)));
+    await workspaceRepo.RevokeSessionAsync(tokenHash, DateTimeOffset.UtcNow.ToString("O"));
+    return Results.Ok(new { success = true });
+}).DisableAntiforgery();
+
+app.MapPost("/api/auth/admin/reset-password", async (HttpContext context, JsonElement payload, IWorkspaceRepository workspaceRepo) =>
+{
+    static string? ReadString(JsonElement root, params string[] names)
+    {
+        foreach (var name in names)
+        {
+            if (root.ValueKind == JsonValueKind.Object && root.TryGetProperty(name, out var property) && property.ValueKind == JsonValueKind.String)
+            {
+                return property.GetString();
+            }
+        }
+
+        return null;
+    }
+
+    var username = ReadString(payload, "adminUsername", "AdminUsername", "username", "Username");
+    var password = ReadString(payload, "adminPassword", "AdminPassword", "password", "Password");
+    var targetUsername = ReadString(payload, "targetUsername", "TargetUsername", "usernameToReset", "UsernameToReset");
+    var newPassword = ReadString(payload, "newPassword", "NewPassword");
+
+    if (!string.Equals(username, adminUsername, StringComparison.Ordinal) || !string.Equals(password, adminPassword, StringComparison.Ordinal))
+    {
+        return Results.Unauthorized();
+    }
+
+    if (string.IsNullOrWhiteSpace(targetUsername) || string.IsNullOrWhiteSpace(newPassword))
+    {
+        return Results.BadRequest(new { success = false, error = "missing_target_or_password" });
+    }
+
+    var account = await workspaceRepo.GetAccountByUsernameAsync(targetUsername.Trim());
+    if (account is null)
+    {
+        return Results.NotFound(new { success = false, error = "account_not_found" });
+    }
+
+    var passwordHash = Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(newPassword)));
+    account.PasswordHash = passwordHash;
+    account.UpdatedAt = DateTimeOffset.UtcNow.ToString("O");
+    var updated = await workspaceRepo.UpsertAccountAsync(account);
+    if (!updated)
+    {
+        return Results.StatusCode(500);
+    }
+
+    return Results.Ok(new
+    {
+        success = true,
+        username = account.Username,
+        updatedAt = account.UpdatedAt
+    });
+}).DisableAntiforgery();
+
 // Operational Report serving API (WASM safe file loading substitute)
 app.MapGet("/api/operational-report", async (IWebHostEnvironment env) =>
 {
@@ -177,9 +346,25 @@ app.MapRazorComponents<App>()
 
 app.Run();
 
-public class LoginRequest
+internal sealed class QuantAdminAuthHandler : AuthenticationHandler<AuthenticationSchemeOptions>
 {
-    public string Username { get; set; } = "";
-    public string Password { get; set; } = "";
+    public QuantAdminAuthHandler(
+        IOptionsMonitor<AuthenticationSchemeOptions> options,
+        ILoggerFactory logger,
+        UrlEncoder encoder)
+        : base(options, logger, encoder)
+    {
+    }
+
+    protected override Task<AuthenticateResult> HandleAuthenticateAsync()
+    {
+        return Task.FromResult(AuthenticateResult.NoResult());
+    }
+
+    protected override Task HandleChallengeAsync(AuthenticationProperties properties)
+    {
+        Response.StatusCode = StatusCodes.Status401Unauthorized;
+        return Task.CompletedTask;
+    }
 }
 

src/dotnet/QuantEngine.Web/QuantEngine.Web.csproj

@@ -8,8 +8,7 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.FluentUI.AspNetCore.Components" Version="5.0.0-rc.4-26177.1" />
-    <PackageReference Include="Microsoft.FluentUI.AspNetCore.Components.Icons" Version="5.0.0-rc.4-26177.1" />
+    <PackageReference Include="MudBlazor" Version="8.6.0" />
     <PackageReference Include="Serilog.AspNetCore" Version="10.0.0" />
     <PackageReference Include="Microsoft.AspNetCore.Components.WebAssembly.Server" Version="10.0.0-preview.2.25120.18" />
   </ItemGroup>

src/dotnet/QuantEngine.Web/appsettings.json

@@ -7,7 +7,7 @@
   },
   "AllowedHosts": "*",
   "ConnectionStrings": {
-    "DefaultConnection": "Host=127.0.0.1;Database=giteadb;Username=gitea;Password=;Search Path=quantengine;"
+    "DefaultConnection": "Host=127.0.0.1;Database=quantenginedb;Username=quantengine_app;Password=;Search Path=quantengine;"
   },
   "AdminSettings": {
     "Username": "admin",

src/dotnet/QuantEngine.Web/wwwroot/favicon.svg

@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" role="img" aria-label="QuantEngine favicon">
+  <defs>
+    <linearGradient id="g" x1="0%" y1="0%" x2="100%" y2="100%">
+      <stop offset="0%" stop-color="#00f2fe"/>
+      <stop offset="100%" stop-color="#4facfe"/>
+    </linearGradient>
+  </defs>
+  <rect width="64" height="64" rx="16" fill="#0b1020"/>
+  <circle cx="32" cy="32" r="22" fill="url(#g)" opacity="0.18"/>
+  <path d="M20 24h12c7.2 0 12 4.5 12 10.8 0 4.6-2.4 8.1-6.5 9.8L45 44h-8l-6.2-6.2H28V44h-8V24Zm8 6v4h4.6c2 0 3.4-.8 3.4-2.1 0-1.4-1.4-1.9-3.3-1.9H28Z" fill="url(#g)"/>
+</svg>

tools/deploy_quantengine.sh

@@ -1,8 +1,12 @@
-#!/bin/bash
-# Quant Engine Shadow Copy Hot Deploy Script
-# To be executed on Hz-Prod-01 Remote Server
+#!/usr/bin/env bash
+# Quant Engine CI-only hot deploy script
 
-set -e
+set -euo pipefail
+
+if [ "${CI_DEPLOY:-0}" != "1" ]; then
+    echo "ERROR: CI-only deployment policy. Use the Gitea workflow to deploy."
+    exit 1
+fi
 
 DEPLOY_BASE="/home/kjh2064/deployments"
 ACTIVE_LINK="/home/kjh2064/quantengine_active"
@@ -15,11 +19,9 @@ echo "========================================="
 echo "Starting Shadow Copy Hot Deploy [${TIMESTAMP}]"
 echo "========================================="
 
-# 1. Ensure directories exist
 mkdir -p "${DEPLOY_BASE}"
 mkdir -p "${TARGET_DIR}"
 
-# 2. Extract build artifact to unique shadow directory
 if [ -f "${TMP_ARCHIVE}" ]; then
     echo "Extracting build artifact to ${TARGET_DIR}..."
     tar -xzf "${TMP_ARCHIVE}" -C "${TARGET_DIR}"
@@ -29,15 +31,12 @@ else
     exit 1
 fi
 
-# 3. Swap symbolic link atomically
 echo "Swapping symbolic link dynamically..."
 ln -sfn "${TARGET_DIR}" "${ACTIVE_LINK}"
 
-# 4. Restart Systemd service (requires passwordless sudo reload or specific policy)
 echo "Restarting Systemd service..."
 sudo systemctl restart quantengine
 
-# 5. Clean up old deployments (keep last 5)
 echo "Cleaning up obsolete deployments..."
 cd "${DEPLOY_BASE}"
 ls -dt quantengine_* | tail -n +6 | while read -r old_dir; do

tools/fix_quantengine_502.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+RESTART=0
+if [[ "${1:-}" == "--restart" ]]; then
+  RESTART=1
+fi
+
+echo "=== QuantEngine 502 Diagnosis ==="
+echo "Host: $(hostname)"
+echo "Time: $(date -Is)"
+echo
+
+echo "=== Service Status ==="
+systemctl is-active quantengine || true
+systemctl is-active nginx || true
+echo
+
+echo "=== Active Deployment ==="
+readlink -f /home/kjh2064/quantengine_active || true
+ls -ld /home/kjh2064/quantengine_active || true
+ls -1dt /home/kjh2064/deployments/quantengine_* 2>/dev/null | head -n 5 || true
+echo
+
+echo "=== Version Marker ==="
+cat /home/kjh2064/quantengine_active/wwwroot/version.json 2>/dev/null || true
+echo
+
+echo "=== Local Port Checks ==="
+ss -ltnp | grep -E ':(5000|443)\s' || true
+echo
+
+echo "=== Loopback HTTP Check ==="
+curl -i --max-time 10 http://127.0.0.1:5000/ || true
+echo
+
+echo "=== Favicon Checks ==="
+curl -i --max-time 10 http://127.0.0.1:5000/favicon.svg || true
+curl -i --max-time 10 http://127.0.0.1:5000/favicon.png || true
+echo
+
+echo "=== Public HTTP Check ==="
+curl -i --max-time 15 https://quant.taxbaik.com/ || true
+echo
+
+echo "=== Nginx Config Test ==="
+nginx -t || true
+echo
+
+echo "=== Recent QuantEngine Logs ==="
+journalctl -u quantengine -n 120 --no-pager || true
+echo
+
+if [[ "$RESTART" -eq 1 ]]; then
+  echo "=== Restarting Services ==="
+  systemctl restart quantengine
+  systemctl reload nginx
+  sleep 2
+  echo
+  echo "=== Post-Restart Status ==="
+  systemctl is-active quantengine || true
+  systemctl is-active nginx || true
+  echo
+  echo "=== Post-Restart Loopback Check ==="
+  curl -i --max-time 10 http://127.0.0.1:5000/ || true
+  echo
+  echo "=== Public Endpoint Check ==="
+  curl -i --max-time 15 https://quant.taxbaik.com/ || true
+fi
+
+echo "=== Next Step ==="
+echo "If http://127.0.0.1:5000/ fails, the problem is inside quantengine."
+echo "If localhost works but the public domain still fails, inspect nginx/proxy config only for quant.taxbaik.com."

tools/migrate_quantengine_schema_to_quantenginedb.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+SRC_DB="${SRC_DB:-giteadb}"
+SRC_USER="${SRC_USER:-gitea}"
+SRC_PASSWORD="${SRC_PASSWORD:-}"
+DST_DB="${DST_DB:-quantenginedb}"
+DST_USER="${DST_USER:-quantengine_app}"
+DST_PASSWORD="${DST_PASSWORD:-}"
+HOST="${HOST:-127.0.0.1}"
+PORT="${PORT:-5432}"
+SCHEMA="${SCHEMA:-quantengine}"
+
+if [ -z "${SRC_PASSWORD}" ] || [ -z "${DST_PASSWORD}" ]; then
+    echo "ERROR: SRC_PASSWORD and DST_PASSWORD must be set."
+    exit 1
+fi
+
+TMP_DIR="$(mktemp -d)"
+trap 'rm -rf "${TMP_DIR}"' EXIT
+
+echo "[1/4] Dumping ${SCHEMA} from ${SRC_DB}..."
+PGPASSWORD="${SRC_PASSWORD}" pg_dump -h "${HOST}" -p "${PORT}" -U "${SRC_USER}" -n "${SCHEMA}" --no-owner --no-privileges "${SRC_DB}" > "${TMP_DIR}/quantengine_schema.sql"
+grep -vE '^CREATE SCHEMA ' "${TMP_DIR}/quantengine_schema.sql" > "${TMP_DIR}/quantengine_schema.filtered.sql"
+
+echo "[2/4] Ensuring destination schema exists..."
+PGPASSWORD="${DST_PASSWORD}" psql -h "${HOST}" -p "${PORT}" -U "${DST_USER}" -d "${DST_DB}" -v ON_ERROR_STOP=1 <<SQL
+CREATE SCHEMA IF NOT EXISTS ${SCHEMA} AUTHORIZATION ${DST_USER};
+ALTER SCHEMA ${SCHEMA} OWNER TO ${DST_USER};
+SQL
+
+echo "[3/4] Restoring into ${DST_DB}..."
+PGPASSWORD="${DST_PASSWORD}" psql -h "${HOST}" -p "${PORT}" -U "${DST_USER}" -d "${DST_DB}" -v ON_ERROR_STOP=1 -f "${TMP_DIR}/quantengine_schema.filtered.sql"
+
+echo "[4/4] Verifying restore..."
+PGPASSWORD="${DST_PASSWORD}" psql -h "${HOST}" -p "${PORT}" -U "${DST_USER}" -d "${DST_DB}" -Atc "SELECT schemaname || '.' || tablename FROM pg_tables WHERE schemaname = '${SCHEMA}' ORDER BY tablename;"
+
+echo "Migration completed: ${SRC_DB}.${SCHEMA} -> ${DST_DB}.${SCHEMA}"

tools/setup_host.sh

@@ -6,6 +6,7 @@ set -e
 
 NGINX_CONF="/etc/nginx/sites-available/gitea-ip.conf"
 SERVICE_FILE="/etc/systemd/system/quantengine.service"
+APP_ENV_FILE="/home/kjh2064/.config/quantengine.env"
 
 echo "========================================="
 echo "Configuring Host Infrastructure Services"
@@ -61,6 +62,7 @@ User=kjh2064
 Environment=ASPNETCORE_ENVIRONMENT=Production
 Environment=ASPNETCORE_URLS=http://127.0.0.1:5000
 Environment=DOTNET_PRINT_TELEMETRY_MESSAGE=false
+EnvironmentFile=-/home/kjh2064/.config/quantengine.env
 
 [Install]
 WantedBy=multi-user.target

tools/setup_quantengine_postgresql_db.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# Create the QuantEngine database and application role on the local PostgreSQL instance.
+
+set -euo pipefail
+
+DB_NAME="${DB_NAME:-quantenginedb}"
+DB_USER="${DB_USER:-quantengine_app}"
+DB_PASSWORD="${DB_PASSWORD:-CHANGE_ME}"
+DB_HOST="${DB_HOST:-127.0.0.1}"
+DB_PORT="${DB_PORT:-5432}"
+ADMIN_DB="${ADMIN_DB:-postgres}"
+SCHEMA_NAME="${SCHEMA_NAME:-quantengine}"
+
+echo "Creating database and role for ${DB_NAME}..."
+sudo -u postgres psql -h "${DB_HOST}" -p "${DB_PORT}" -d "${ADMIN_DB}" -v ON_ERROR_STOP=1 <<SQL
+DO \$\$
+BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${DB_USER}') THEN
+        CREATE ROLE ${DB_USER} LOGIN PASSWORD '${DB_PASSWORD}';
+    ELSE
+        ALTER ROLE ${DB_USER} WITH LOGIN PASSWORD '${DB_PASSWORD}';
+    END IF;
+END
+\$\$;
+
+DO \$\$
+BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = '${DB_NAME}') THEN
+        CREATE DATABASE ${DB_NAME} OWNER ${DB_USER};
+    END IF;
+END
+\$\$;
+SQL
+
+sudo -u postgres psql -h "${DB_HOST}" -p "${DB_PORT}" -d "${DB_NAME}" -v ON_ERROR_STOP=1 <<SQL
+CREATE SCHEMA IF NOT EXISTS ${SCHEMA_NAME} AUTHORIZATION ${DB_USER};
+GRANT ALL PRIVILEGES ON DATABASE ${DB_NAME} TO ${DB_USER};
+GRANT USAGE, CREATE ON SCHEMA ${SCHEMA_NAME} TO ${DB_USER};
+ALTER SCHEMA ${SCHEMA_NAME} OWNER TO ${DB_USER};
+SQL
+
+APP_ENV_FILE="${APP_ENV_FILE:-/home/kjh2064/.config/quantengine.env}"
+
+mkdir -p "$(dirname "${APP_ENV_FILE}")"
+cat > "${APP_ENV_FILE}" <<EOF
+ConnectionStrings__DefaultConnection=Host=127.0.0.1;Database=${DB_NAME};Username=${DB_USER};Password=${DB_PASSWORD};Search Path=${SCHEMA_NAME};
+EOF
+
+chmod 600 "${APP_ENV_FILE}"
+
+echo "Database setup completed: ${DB_NAME} / ${DB_USER}"
+echo "Wrote app env file: ${APP_ENV_FILE}"

tools/setup_quantenginedb.sql

@@ -0,0 +1,22 @@
+DO $$
+BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'quantengine_app') THEN
+        CREATE ROLE quantengine_app LOGIN PASSWORD 'CHANGE_ME';
+    END IF;
+END
+$$;
+
+DO $$
+BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = 'quantenginedb') THEN
+        CREATE DATABASE quantenginedb OWNER quantengine_app;
+    END IF;
+END
+$$;
+
+\connect quantenginedb
+
+CREATE SCHEMA IF NOT EXISTS quantengine AUTHORIZATION quantengine_app;
+ALTER SCHEMA quantengine OWNER TO quantengine_app;
+GRANT ALL PRIVILEGES ON DATABASE quantenginedb TO quantengine_app;
+GRANT USAGE, CREATE ON SCHEMA quantengine TO quantengine_app;

tools/verify_quantengine_db_setup.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+DB_HOST="${DB_HOST:-127.0.0.1}"
+DB_PORT="${DB_PORT:-5432}"
+DB_USER="${DB_USER:-quantengine_app}"
+DB_NAME="${DB_NAME:-quantenginedb}"
+
+echo "Checking database availability..."
+psql "host=${DB_HOST} port=${DB_PORT} dbname=${DB_NAME} user=${DB_USER}" -Atc "select current_database(), current_schema();"
+echo "Checking core tables..."
+psql "host=${DB_HOST} port=${DB_PORT} dbname=${DB_NAME} user=${DB_USER}" -Atc "\dt quantengine.*"

tools/verify_quantengine_migration.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+DB_HOST="${DB_HOST:-127.0.0.1}"
+DB_PORT="${DB_PORT:-5432}"
+DB_USER="${DB_USER:-quantengine_app}"
+DB_PASSWORD="${DB_PASSWORD:-}"
+DB_NAME="${DB_NAME:-quantenginedb}"
+SCHEMA="${SCHEMA:-quantengine}"
+
+if [ -z "${DB_PASSWORD}" ]; then
+    echo "ERROR: DB_PASSWORD must be set."
+    exit 1
+fi
+
+echo "Row counts in ${DB_NAME}.${SCHEMA}:"
+for table in workspace_account workspace_session settings account_snapshot workspace_approval_v2 workspace_lock kis_tokens kis_collection_runs kis_collection_snapshots kis_collection_errors; do
+    count=$(PGPASSWORD="${DB_PASSWORD}" psql -h "${DB_HOST}" -p "${DB_PORT}" -U "${DB_USER}" -d "${DB_NAME}" -Atc "SELECT COUNT(*) FROM ${SCHEMA}.${table};" 2>/dev/null || echo "MISSING")
+    printf '%s %s\n' "${table}" "${count}"
+done