feat: production-harden app and finalize merge-ready UX/theme baseline

- complete tokenized theme preset system and admin style guide visibility
- refine dashboard layout/scroll behavior and shared async/request UI states
- add user nav-visibility settings across API, migration, and frontend stores
- harden security headers/CSP handling and related test coverage
- enforce CI repository hygiene + frontend contract/theme/build quality gates
- update docs/env references and make migration smoke test head-aware

app/db/models.py

@@ -98,6 +98,13 @@ class UserSetting(Base):
     request_delay_seconds: Mapped[int] = mapped_column(
         Integer, nullable=False, server_default=text("10")
     )
+    nav_visible_pages: Mapped[list[str]] = mapped_column(
+        JSONB,
+        nullable=False,
+        server_default=text(
+            '\'["dashboard","scholars","publications","settings","style-guide","runs","users"]\'::jsonb'
+        ),
+    )
     created_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True), nullable=False, server_default=func.now()
     )