feat: production-harden app and finalize merge-ready UX/theme baseline

- complete tokenized theme preset system and admin style guide visibility
- refine dashboard layout/scroll behavior and shared async/request UI states
- add user nav-visibility settings across API, migration, and frontend stores
- harden security headers/CSP handling and related test coverage
- enforce CI repository hygiene + frontend contract/theme/build quality gates
- update docs/env references and make migration smoke test head-aware

tests/integration/test_api_v1.py

@@ -593,6 +593,7 @@ async def test_api_settings_get_and_update(db_session: AsyncSession) -> None:
     get_response = client.get("/api/v1/settings")
     assert get_response.status_code == 200
     assert "request_delay_seconds" in get_response.json()["data"]
+    assert "nav_visible_pages" in get_response.json()["data"]
 
     update_response = client.put(
         "/api/v1/settings",
@@ -600,6 +601,7 @@ async def test_api_settings_get_and_update(db_session: AsyncSession) -> None:
             "auto_run_enabled": True,
             "run_interval_minutes": 45,
             "request_delay_seconds": 6,
+            "nav_visible_pages": ["dashboard", "scholars", "publications", "settings", "runs"],
         },
         headers=headers,
     )
@@ -608,6 +610,13 @@ async def test_api_settings_get_and_update(db_session: AsyncSession) -> None:
     assert updated["auto_run_enabled"] is True
     assert updated["run_interval_minutes"] == 45
     assert updated["request_delay_seconds"] == 6
+    assert updated["nav_visible_pages"] == [
+        "dashboard",
+        "scholars",
+        "publications",
+        "settings",
+        "runs",
+    ]
 
 
 @pytest.mark.integration

tests/integration/test_migrations.py

@@ -14,7 +14,7 @@ EXPECTED_TABLES = {
 }
 
 EXPECTED_ENUMS = {"run_status", "run_trigger_type"}
-EXPECTED_REVISION = "20260217_0007"
+EXPECTED_REVISION = "20260219_0008"
 
 
 @pytest.mark.integration
@@ -182,3 +182,20 @@ async def test_scholar_profiles_has_initial_page_snapshot_columns(db_session: As
         "last_initial_page_fingerprint_sha256",
         "last_initial_page_checked_at",
     }
+
+
+@pytest.mark.integration
+@pytest.mark.db
+@pytest.mark.migrations
+@pytest.mark.asyncio
+async def test_user_settings_has_nav_visible_pages_column(db_session: AsyncSession) -> None:
+    result = await db_session.execute(
+        text(
+            """
+            SELECT 1
+            FROM information_schema.columns
+            WHERE table_name = 'user_settings' AND column_name = 'nav_visible_pages'
+            """
+        )
+    )
+    assert result.scalar_one() == 1