Add tests and implement StubBearer authentication for Signer endpoints

- Created SignerEndpointsTests to validate the SignDsse and VerifyReferrers endpoints.
- Implemented StubBearerAuthenticationDefaults and StubBearerAuthenticationHandler for token-based authentication.
- Developed ConcelierExporterClient for managing Trivy DB settings and export operations.
- Added TrivyDbSettingsPageComponent for UI interactions with Trivy DB settings, including form handling and export triggering.
- Implemented styles and HTML structure for Trivy DB settings page.
- Created NotifySmokeCheck tool for validating Redis event streams and Notify deliveries.

docs/24_OFFLINE_KIT.md

@@ -37,7 +37,9 @@ cosign verify-blob \
   --key https://stella-ops.org/keys/cosign.pub \
   --signature stella-ops-offline-kit-<DATE>.tgz.sig \
   stella-ops-offline-kit-<DATE>.tgz
-````
+````
+
+**CLI shortcut.** `stellaops-cli offline kit pull --destination ./offline-kit` downloads the bundle, manifest, and detached signatures in one step, resumes partial transfers, and writes a `.metadata.json` summary for later import.
 
 Verification prints **OK** and the SHA‑256 digest; cross‑check against the
 [changelog](https://git.stella-ops.org/stella-ops/offline-kit/-/releases).
@@ -60,11 +62,22 @@ The manifest enumerates every artefact (`name`, `sha256`, `size`, `capturedAt`)
 ## 2 · Import on the air‑gapped host
 
 ```bash
-docker compose --env-file .env \
-  -f docker-compose.stella-ops.yml \
-  exec stella-ops \
-  stella admin import-offline-usage-kit stella-ops-offline-kit-<DATE>.tgz
-```
+docker compose --env-file .env \
+  -f docker-compose.stella-ops.yml \
+  exec stella-ops \
+  stella admin import-offline-usage-kit stella-ops-offline-kit-<DATE>.tgz
+```
+
+Alternatively, run
+
+```bash
+stellaops-cli offline kit import stella-ops-offline-kit-<DATE>.tgz \
+  --manifest offline-manifest-<DATE>.json \
+  --bundle-signature stella-ops-offline-kit-<DATE>.tgz.sig \
+  --manifest-signature offline-manifest-<DATE>.json.jws
+```
+
+The CLI validates recorded digests (when `.metadata.json` is present) before streaming the multipart payload to `/api/offline-kit/import`.
 
 * The CLI validates the Cosign signature **before** activation.
 * Old feeds are kept until the new bundle is fully verified.