fix(ui/security): Enforce idempotent AI fetching, secure auth handler, and memory leak guards (#45)

This PR provides critical stabilization, memory leak resolution, and security enhancements for the NexusReader application, specifically focusing on Blazor InteractiveAuto lifecycle safety, thread-safe automated authentication token refresh, and deduplication of active AI service queries.

### Key Enhancements

#### 1. Security & Lifecycle Stabilization (`AuthenticationHeaderHandler.cs` & `Library.razor`)
* **Secure Token Propagation (CWE-200)**: Modified the outbound delegating handler to only append JWT Bearer headers to trusted base origin requests matching the application's configured `NavigationManager.BaseUri`, preventing potential token leakage to external services.
* **Captive Dependency & Memory Leak Fix (CWE-400)**: Avoided capturing scoped dependencies in a singleton handler by wrapping the resolution of `IIdentityService` inside a dedicated, disposable `IServiceProvider` scope (`_serviceProvider.CreateScope()`).
* **Thread-Safe Automated Refresh**: Embedded a `SemaphoreSlim` lock around the automated `RefreshTokenAsync` renewal sequence to handle concurrent API requests gracefully without triggering duplicate token refresh attempts.
* **Pre-rendering Safety**: Deferred the secure book loading query in `Library.razor` from `OnInitializedAsync` to client-side `OnAfterRenderAsync(firstRender: true)` to avoid inevitable `401 Unauthorized` responses and logs during the server pre-rendering phase.

#### 2. Robust AI Request Deduplication (`KnowledgeService.cs`)
* **State Recovery Guards**: Enhanced the thread-safe `Lazy<Task<Result<KnowledgePacket>>>` deduplication map by adding thorough failure handling blocks. Active requests are guaranteed to be cleaned up (`TryRemove`) inside `finally` and failed results pathways, ensuring future retries can run immediately if an initial request encounters an error.

#### 3. Idempotent AI UI Fetching & JSRuntime Guards
* **Interactive Guards**: Added an `_isInteractive` check to `GroundednessBadge.razor` and `AiAssistantBubble.razor` components, deferring WebAssembly API executions and DOM updates to client-side `OnAfterRenderAsync`.
* **State Synchronization**: Integrated a synchronous `OnParametersSet` to properly reset groundedness badges when content changes.
* **Flicker Elimination**: Moved JSRuntime local-storage checks in `Home.razor` (for focus mode preferences) to `OnAfterRenderAsync(firstRender: true)`, resolving startup JSInterop exceptions and eliminating layout shifts.

### Verification Performed
* Mandatory build gate verified: `Kompilacja powiodła się.` with zero compile errors (`dotnet build NexusReader.slnx --no-restore`).
* Validated dependency resolution patterns and async safety (no `async void`).

---------

Co-authored-by: Marek Jasiński <jasins.marek@gmail.com>
Reviewed-on: #45
Reviewed-by: Marek Jaisński <jasins.marek@gmail.com>
Co-authored-by: Antigravity <antigravity@google.com>
Co-committed-by: Antigravity <antigravity@google.com>

src/NexusReader.UI.Shared/Components/Molecules/AiAssistantBubble.razor

@@ -51,9 +51,13 @@
     private string _lastFetchedBlockId = string.Empty;
     private KnowledgePacket? _packet;
     private CancellationTokenSource? _streamCts;
+    private bool _isInteractive;
 
     protected override async Task OnParametersSetAsync()
     {
+        if (!_isInteractive)
+            return;
+
         // Only re-fetch when the block context actually changes
         if (string.IsNullOrEmpty(ContextBlockId) || ContextBlockId == _lastFetchedBlockId)
             return;
@@ -62,6 +66,19 @@
         await FetchAndStreamAsync();
     }
 
+    protected override async Task OnAfterRenderAsync(bool firstRender)
+    {
+        if (firstRender)
+        {
+            _isInteractive = true;
+            if (!string.IsNullOrEmpty(ContextBlockId))
+            {
+                _lastFetchedBlockId = ContextBlockId;
+                await FetchAndStreamAsync();
+            }
+        }
+    }
+
     private async Task FetchAndStreamAsync()
     {
         // Cancel any in-progress stream

src/NexusReader.UI.Shared/Components/Molecules/GroundednessBadge.razor

@@ -26,15 +26,40 @@
 
     private GroundednessResult? _result;
     private bool _isChecking;
+    private bool _isInteractive;
+    private string _previousAnswer = string.Empty;
+    private string _previousContext = string.Empty;
+
+    protected override void OnParametersSet()
+    {
+        if (Answer != _previousAnswer || Context != _previousContext)
+        {
+            _result = null;
+            _previousAnswer = Answer;
+            _previousContext = Context;
+        }
+    }
 
     protected override async Task OnParametersSetAsync()
     {
-        if (!string.IsNullOrEmpty(Answer) && !string.IsNullOrEmpty(Context) && _result == null)
+        if (_isInteractive && !string.IsNullOrEmpty(Answer) && !string.IsNullOrEmpty(Context) && _result == null)
         {
             await RunCheck();
         }
     }
 
+    protected override async Task OnAfterRenderAsync(bool firstRender)
+    {
+        if (firstRender)
+        {
+            _isInteractive = true;
+            if (!string.IsNullOrEmpty(Answer) && !string.IsNullOrEmpty(Context) && _result == null)
+            {
+                await RunCheck();
+            }
+        }
+    }
+
     private async Task RunCheck()
     {
         _isChecking = true;