feat: production-harden app and finalize merge-ready UX/theme baseline

- complete tokenized theme preset system and admin style guide visibility
- refine dashboard layout/scroll behavior and shared async/request UI states
- add user nav-visibility settings across API, migration, and frontend stores
- harden security headers/CSP handling and related test coverage
- enforce CI repository hygiene + frontend contract/theme/build quality gates
- update docs/env references and make migration smoke test head-aware

app/api/routers/settings.py

@@ -23,6 +23,7 @@ def _serialize_settings(settings) -> dict[str, object]:
         "auto_run_enabled": bool(settings.auto_run_enabled),
         "run_interval_minutes": int(settings.run_interval_minutes),
         "request_delay_seconds": int(settings.request_delay_seconds),
+        "nav_visible_pages": list(settings.nav_visible_pages or []),
     }
 
 
@@ -55,6 +56,11 @@ async def update_settings(
     db_session: AsyncSession = Depends(get_db_session),
     current_user: User = Depends(get_api_current_user),
 ):
+    settings = await user_settings_service.get_or_create_settings(
+        db_session,
+        user_id=current_user.id,
+    )
+
     try:
         parsed_interval = user_settings_service.parse_run_interval_minutes(
             str(payload.run_interval_minutes)
@@ -62,6 +68,11 @@ async def update_settings(
         parsed_delay = user_settings_service.parse_request_delay_seconds(
             str(payload.request_delay_seconds)
         )
+        parsed_nav_visible_pages = user_settings_service.parse_nav_visible_pages(
+            payload.nav_visible_pages
+            if payload.nav_visible_pages is not None
+            else list(settings.nav_visible_pages or user_settings_service.DEFAULT_NAV_VISIBLE_PAGES)
+        )
     except user_settings_service.UserSettingsServiceError as exc:
         raise ApiException(
             status_code=400,
@@ -69,16 +80,13 @@ async def update_settings(
             message=str(exc),
         ) from exc
 
-    settings = await user_settings_service.get_or_create_settings(
-        db_session,
-        user_id=current_user.id,
-    )
     updated = await user_settings_service.update_settings(
         db_session,
         settings=settings,
         auto_run_enabled=bool(payload.auto_run_enabled),
         run_interval_minutes=parsed_interval,
         request_delay_seconds=parsed_delay,
+        nav_visible_pages=parsed_nav_visible_pages,
     )
     logger.info(
         "api.settings.updated",
@@ -88,6 +96,7 @@ async def update_settings(
             "auto_run_enabled": updated.auto_run_enabled,
             "run_interval_minutes": updated.run_interval_minutes,
             "request_delay_seconds": updated.request_delay_seconds,
+            "nav_visible_pages": updated.nav_visible_pages,
         },
     )
     return success_payload(

app/api/schemas.py

@@ -433,6 +433,7 @@ class SettingsData(BaseModel):
     auto_run_enabled: bool
     run_interval_minutes: int
     request_delay_seconds: int
+    nav_visible_pages: list[str]
 
     model_config = ConfigDict(extra="forbid")
 
@@ -448,6 +449,7 @@ class SettingsUpdateRequest(BaseModel):
     auto_run_enabled: bool
     run_interval_minutes: int
     request_delay_seconds: int
+    nav_visible_pages: list[str] | None = None
 
     model_config = ConfigDict(extra="forbid")