fix(auth): resolve JWT InvalidSignatureError and improve frontend UX

- Fix auth by using idToken fallback when accessToken audience mismatches
- Add PyJWT verification with audience-aware token selection in frontend
- Source health: track last_attempt_time and error status per source
- Frontend: fix modal outside x-data scope, add circular-safe JSON stringify
- Frontend: support multi-select service filter with All/None toggles
- Frontend: improve filter layout into organized rows
- Frontend: fix text overflow and result pill colors (success/succeeded)
- Intune: normalize application actors (auditActorType=Application)
- Add cache-control middleware for HTML/API responses
- Update tests for multi-service filtering and source health

backend/routes/health.py

@@ -15,16 +15,21 @@ def source_health():
     results = []
     for source in SOURCES:
         doc = watermarks_collection.find_one({"source": source})
-        if doc and doc.get("last_fetch_time"):
+        if doc:
+            status = doc.get("status")
+            if not status:
+                status = "healthy" if doc.get("last_fetch_time") else "unknown"
             results.append({
                 "source": source,
-                "last_fetch_time": doc["last_fetch_time"],
-                "status": "healthy",
+                "last_fetch_time": doc.get("last_fetch_time"),
+                "last_attempt_time": doc.get("last_attempt_time"),
+                "status": status,
             })
         else:
             results.append({
                 "source": source,
                 "last_fetch_time": None,
+                "last_attempt_time": None,
                 "status": "unknown",
             })
     return results