feat: production-harden app and finalize merge-ready UX/theme baseline

- complete tokenized theme preset system and admin style guide visibility
- refine dashboard layout/scroll behavior and shared async/request UI states
- add user nav-visibility settings across API, migration, and frontend stores
- harden security headers/CSP handling and related test coverage
- enforce CI repository hygiene + frontend contract/theme/build quality gates
- update docs/env references and make migration smoke test head-aware

frontend/src/app/providers.ts

@@ -1,6 +1,7 @@
 import { setCsrfTokenProvider } from "@/lib/api/client";
 import { useAuthStore } from "@/stores/auth";
 import { useThemeStore } from "@/stores/theme";
+import { useUserSettingsStore } from "@/stores/user_settings";
 
 export async function bootstrapAppProviders(): Promise<void> {
   const theme = useThemeStore();
@@ -9,4 +10,11 @@ export async function bootstrapAppProviders(): Promise<void> {
   const auth = useAuthStore();
   setCsrfTokenProvider(() => auth.csrfToken);
   await auth.bootstrapSession();
+
+  const userSettings = useUserSettingsStore();
+  if (auth.isAuthenticated) {
+    await userSettings.bootstrap();
+  } else {
+    userSettings.reset();
+  }
 }