Prepare integrated webapp showcase baseline

[xrpbanks]

Purpose

Prepare a small, verifiable candidate for the working WordPress–CalorieApp integration before the final showcase acceptance round.

Changes

• prove that the Xaman dialog closes only after both WordPress and CalorieApp confirm the joint session;
• fix deterministic Identity Bridge release artifact path reporting;
• expose the same non-secret build identifier in backend /health and frontend HTML;
• allow the read-only deployment smoke test to require that exact build identifier;
• document the deployment setting without adding credentials or private configuration.

Verified evidence

• remote tree: 94cce05b4689511a0fb06b8cc19f942e7d1ab68a;
• remote tree exactly matches the locally tested tree;
• full offline release check passed;
• 239 backend tests passed with one known Starlette TestClient deprecation warning;
• Identity Bridge and eleven-locale tests passed;
• frontend lint and production build passed;
• legal/licensing and tracked-artifact boundaries passed;
• deterministic plugin 0.3.0 archive SHA-256: f4b41d804b346efeebb586d585cebb7c986b6d5f2444d2560eeb642abb43aad8.

Deliberately not done

• no merge;
• no deployment or WordPress installation;
• no publication;
• no new live Xaman login or personal-data mutation;
• no claim that the currently deployed frontend/plugin already matches this candidate.

The hosting protection returned a browser verification page to automated DOM inspection. The canonical WordPress CalorieApp URL did return HTTP 200, but a final live browser acceptance round remains required after a deployment candidate exposes the expected build identifier.