fix(ui/security): Enforce idempotent AI fetching, secure auth handler, and memory leak guards (#45)

This PR provides critical stabilization, memory leak resolution, and security enhancements for the NexusReader application, specifically focusing on Blazor InteractiveAuto lifecycle safety, thread-safe automated authentication token refresh, and deduplication of active AI service queries.

### Key Enhancements

#### 1. Security & Lifecycle Stabilization (`AuthenticationHeaderHandler.cs` & `Library.razor`)
* **Secure Token Propagation (CWE-200)**: Modified the outbound delegating handler to only append JWT Bearer headers to trusted base origin requests matching the application's configured `NavigationManager.BaseUri`, preventing potential token leakage to external services.
* **Captive Dependency & Memory Leak Fix (CWE-400)**: Avoided capturing scoped dependencies in a singleton handler by wrapping the resolution of `IIdentityService` inside a dedicated, disposable `IServiceProvider` scope (`_serviceProvider.CreateScope()`).
* **Thread-Safe Automated Refresh**: Embedded a `SemaphoreSlim` lock around the automated `RefreshTokenAsync` renewal sequence to handle concurrent API requests gracefully without triggering duplicate token refresh attempts.
* **Pre-rendering Safety**: Deferred the secure book loading query in `Library.razor` from `OnInitializedAsync` to client-side `OnAfterRenderAsync(firstRender: true)` to avoid inevitable `401 Unauthorized` responses and logs during the server pre-rendering phase.

#### 2. Robust AI Request Deduplication (`KnowledgeService.cs`)
* **State Recovery Guards**: Enhanced the thread-safe `Lazy<Task<Result<KnowledgePacket>>>` deduplication map by adding thorough failure handling blocks. Active requests are guaranteed to be cleaned up (`TryRemove`) inside `finally` and failed results pathways, ensuring future retries can run immediately if an initial request encounters an error.

#### 3. Idempotent AI UI Fetching & JSRuntime Guards
* **Interactive Guards**: Added an `_isInteractive` check to `GroundednessBadge.razor` and `AiAssistantBubble.razor` components, deferring WebAssembly API executions and DOM updates to client-side `OnAfterRenderAsync`.
* **State Synchronization**: Integrated a synchronous `OnParametersSet` to properly reset groundedness badges when content changes.
* **Flicker Elimination**: Moved JSRuntime local-storage checks in `Home.razor` (for focus mode preferences) to `OnAfterRenderAsync(firstRender: true)`, resolving startup JSInterop exceptions and eliminating layout shifts.

### Verification Performed
* Mandatory build gate verified: `Kompilacja powiodła się.` with zero compile errors (`dotnet build NexusReader.slnx --no-restore`).
* Validated dependency resolution patterns and async safety (no `async void`).

---------

Co-authored-by: Marek Jasiński <jasins.marek@gmail.com>
Reviewed-on: #45
Reviewed-by: Marek Jaisński <jasins.marek@gmail.com>
Co-authored-by: Antigravity <antigravity@google.com>
Co-committed-by: Antigravity <antigravity@google.com>

src/NexusReader.Infrastructure/Services/KnowledgeService.cs

@@ -31,7 +31,7 @@ public class KnowledgeService : IKnowledgeService
     private readonly Tokenizer _tokenizer;
     private readonly ILogger<KnowledgeService> _logger;
     private const string PromptVersion = "1.3";
-    private static readonly ConcurrentDictionary<string, Task<Result<KnowledgePacket>>> _activeRequests = new();
+    private static readonly ConcurrentDictionary<string, Lazy<Task<Result<KnowledgePacket>>>> _activeRequests = new();
 
     public KnowledgeService(
         IChatClient chatClient,
@@ -100,10 +100,35 @@ public class KnowledgeService : IKnowledgeService
 
         // Deduplicate concurrent active requests for the exact same hash
         var requestKey = $"{tenantId}:{hash}:{traceType}";
-        var task = _activeRequests.GetOrAdd(requestKey, _ => 
-            ExecuteAiRequestAndCacheAsync(normalizedText, tenantId, systemPrompt, traceType, ebookId, hash));
+        
+        var lazyTask = _activeRequests.GetOrAdd(requestKey, k => 
+            new Lazy<Task<Result<KnowledgePacket>>>(
+                () => ExecuteAiRequestAndCacheAsync(normalizedText, tenantId, systemPrompt, traceType, ebookId, hash),
+                System.Threading.LazyThreadSafetyMode.ExecutionAndPublication
+            ));
 
-        return await task;
+        try
+        {
+            var result = await lazyTask.Value;
+
+            // If the AI call returned a failure, remove it from the active dictionary 
+            // so subsequent retries have a chance to request the AI again.
+            if (result.IsFailed)
+            {
+                _activeRequests.TryRemove(requestKey, out _);
+            }
+
+            return result;
+        }
+        catch (Exception)
+        {
+            _activeRequests.TryRemove(requestKey, out _);
+            throw;
+        }
+        finally
+        {
+            _activeRequests.TryRemove(requestKey, out _);
+        }
     }
 
     private async Task<Result<KnowledgePacket>> ExecuteAiRequestAndCacheAsync(