Release v16.25.0

Added

• WithTlsCertificate and WithEncryptionCertificate on the Aspire builder, which mount a certificate into the Chronicle container read-only and point the configuration at it (#3607)

Changed

• An Aspire AppHost configured for production must now supply a TLS certificate, and an encryption certificate when the internal OAuth authority is enabled — without them the production image does not start (#3607)

Fixed

• An Aspire AppHost that configures Chronicle for production now runs the production image, instead of the development image that ships development credentials and an anonymous state-reset endpoint (#3607)
• A TLS certificate without a password now loads, instead of failing the server's startup with a cryptographic error
• A certificate path that does not exist now fails the AppHost immediately, instead of producing a container that reports itself running while its process has died (#3607)
• Configuring either certificate twice now replaces the earlier call, instead of producing a container Docker refuses to start (#3607)

Security

• An Aspire AppHost configured for production no longer runs a development-compiled Chronicle, which seeds a documented default administrator password and a fixed OAuth client secret, and exposes an unauthenticated endpoint that erases the event store (#3607)