feat(infra): Docker-compose configuration and environment-specific security guards for Beta deployment to Test environment (#56)

This pull request introduces the dedicated containerized infrastructure and configuration for deploying NexusReader's beta version in the Test environment.

### Summary of Changes

1. **Docker Infrastructure & Secrets**:
   - **`docker-compose.test.yml`**: Configured dedicated database and auxiliary services (PostgreSQL 17, Qdrant, Neo4j) on isolated, non-standard ports to ensure zero conflict with the existing server configurations.
   - **`.env.test.template`**: Provided an environment variable template showing required setups, including mandatory database passwords, API keys, and admin custom passwords.
   - **`.gitignore`**: Excluded local `.env` files to prevent accidental commits of production or staging secrets.

2. **Database Hardening**:
   - Configured Neo4j with basic authentication (`IDriver` instantiation uses basic auth when credentials are provided in configuration).
   - Configured PostgreSQL to use mandatory authentication.
   - Configured the admin seeder (`DbInitializer.cs`) to dynamically use `NEXUS_ADMIN_PASSWORD` from environment variables, falling back to a default password in local Development only.

3. **Feature-Flagged Restrictions**:
   - **`appsettings.Test.json`**: Implemented `Features:AllowRegistration` and `Features:AllowPasswordReset` flags set to `false`.
   - **Middleware Enforcement (`Program.cs`)**: Intercepts requests to `/identity/register` and `/identity/forgotPassword` (and their MVC/form variations) and rejects them with a `403 Forbidden` response in restricted environments.
   - **OAuth Provisioning Guard (`Program.cs`)**: Blocks new account provisioning via Google OAuth callback by checking the `Features:AllowRegistration` configuration, redirecting users to the login page with a descriptive error.
   - **UI Protection (`Login.razor`, `Register.razor`)**: Conditionally hides registration/password reset links and intercepts manual navigation attempts to `/account/register` by redirecting to login with a warning.

---------

Co-authored-by: Marek Jasiński <jasins.marek@gmail.com>
Reviewed-on: #56
Co-authored-by: Antigravity <antigravity@google.com>
Co-committed-by: Antigravity <antigravity@google.com>

src/NexusReader.UI.Shared/Services/NexusAuthenticationStateProvider.cs

@@ -4,20 +4,24 @@ using Microsoft.AspNetCore.Components.Authorization;
 using NexusReader.Application.Abstractions.Services;
 using NexusReader.Application.Constants;
 
+using Microsoft.AspNetCore.Components;
+
 namespace NexusReader.UI.Shared.Services;
 
 public class NexusAuthenticationStateProvider : AuthenticationStateProvider
 {
     private readonly INativeStorageService _storageService;
+    private readonly PersistentComponentState _persistentState;
     
     // SECURITY NOTE: We currently store roles in local storage to persist state across refreshes.
     // In a production SaaS environment, consider using ProtectedBrowserStorage (Blazor Server) 
     // or encrypted storage/JWT claims validation to prevent client-side role tampering.
     private const string TokenKey = StorageKeys.AuthToken;
 
-    public NexusAuthenticationStateProvider(INativeStorageService storageService)
+    public NexusAuthenticationStateProvider(INativeStorageService storageService, PersistentComponentState persistentState)
     {
         _storageService = storageService;
+        _persistentState = persistentState;
     }
 
     public void ClearCache()
@@ -34,11 +38,23 @@ public class NexusAuthenticationStateProvider : AuthenticationStateProvider
         {
             if (_cachedState != null) return _cachedState;
 
+            // 0. Hydrate state from SSR if available in PersistentComponentState
+            if (_persistentState.TryTakeFromJson<UserInfo>("UserInfo", out var userInfo) && userInfo != null)
+            {
+                // Save to local storage for subsequent client-only transitions/refreshes
+                await _storageService.SaveSecureString(StorageKeys.UserEmail, userInfo.Email);
+                await _storageService.SaveSecureString(StorageKeys.UserTenant, userInfo.TenantId);
+                await _storageService.SaveSecureString(StorageKeys.UserRoles, userInfo.Roles);
+
+                _cachedState = CreateState(userInfo.Email, userInfo.TenantId, "FederatedHydration", userInfo.Roles);
+                return _cachedState;
+            }
+
             var tokenResult = await _storageService.GetSecureString(TokenKey);
             var token = tokenResult.IsSuccess ? tokenResult.Value : null;
 
             // 1. Try Token-based auth
-            if (!string.IsNullOrWhiteSpace(token))
+            if (!string.IsNullOrWhiteSpace(token) && !JwtTokenValidator.IsExpired(token))
             {
                 var emailResult = await _storageService.GetSecureString(StorageKeys.UserEmail);
                 var tenantIdResult = await _storageService.GetSecureString(StorageKeys.UserTenant);
@@ -116,3 +132,10 @@ public class NexusAuthenticationStateProvider : AuthenticationStateProvider
         NotifyAuthenticationStateChanged(Task.FromResult(new AuthenticationState(guest)));
     }
 }
+
+public class UserInfo
+{
+    public string Email { get; set; } = string.Empty;
+    public string TenantId { get; set; } = string.Empty;
+    public string Roles { get; set; } = string.Empty;
+}