feat(ui): implement premium gamified Concepts Map dashboard, unify design tokens, and enforce scoped CSS (#54)

Resolves #55

# gamified Concepts Map Dashboard, Architecture Cleanup, & CSS Unification

This Pull Request completes the gamified **Concepts Map** interactive experience and executes a strict visual and architectural clean-up of the **NexusReader SaaS** platform by consolidating styling around the centralized **Nexus Neon** design system, enforcing Native AOT-compliant scoped-CSS, and resolving style drift.

---

### 🚀 Key Implementations

#### 1. Gamified Interactive Concepts Map Dashboard
* **Dynamic Skill-Tree Visualizer:** Implemented a gamified node-based interactive tree that reads concept connections dynamically, rendering progress nodes, unlocked/locked states, and active visual connection lines.
* **Premium UX Details:** Integrated high-fidelity hover effects, detailed sidebar popovers showing unlocked stats/summaries, and smooth parallax backdrops.
* **Secure Multi-Tenant Gating:** Hardened data queries using explicit `TenantId` gating to ensure complete layout isolation between system tenants.

#### 2. Architecture & Service Optimization
* **Service Abstraction (`IConceptsMapService`):** Introduced a clean service interface decoupled from the UI layers.
* **Polyglot Fallback Implementations:**
  - **WasmConceptsMapService:** Implements efficient client-side fetching with error recovery/loading states.
  - **ServerConceptsMapService:** Handles deep database graph mapping, relationship resolution, and multi-tenant checks.
* **CQRS Integrity:** Enforced the CQRS Result Pattern by using `MediatR` handlers to fetch data structures instead of placing database queries in UI modules.

#### 3. Nexus Neon CSS Unification & Zero-Style-Tag Standards
* **Central Design Tokens:** Solidified typography (`Inter` / `Merriweather`), primary brand green hues (`var(--nexus-neon)` at `#00ff99`), and glow variables inside the global `app.css`.
* **Zero Inline Style Tags:** Standardized all dashboard modules by completely eliminating inline `<style>` blocks in favor of scoped `.razor.css` companion files.
* **Consolidated Buttons & Glass Panels:**
  - Standardized `.btn-nexus`, `.btn-nexus-primary`, and `.btn-nexus-secondary` throughout header/footer/card operations.
  - Removed duplicate `.glass-panel` background, blur, and support-declaration overrides, making components cleanly inherit standard global styles.
* **Eliminated Brand Splitting:** Resolved legacy purple-indigo user avatar and conversation bubble gradients inside the AI Intelligence Hub (`Intelligence.razor.css`), migrating them to premium glassmorphic surfaces (`rgba(255, 255, 255, 0.05)`) contrasting beautifully against the emerald green AI theme.

---

### 🧪 Verification & Build Gate Status

* **Successful Compilation Check:** Run `dotnet build NexusReader.slnx --no-restore` from the workspace root. Flawlessly succeeded with **zero compilation errors** (`Liczba błędów: 0`) under target `.NET 10`.
* **Verified Skills Synchrony:** The companion design guidelines skill (`nexus-ui-engine/SKILL.md`) has been fully updated to secure these layout and styling conventions for future dashboard features.

---------

Co-authored-by: Marek Jasiński <jasins.marek@gmail.com>
Reviewed-on: #54
Co-authored-by: Antigravity <antigravity@google.com>
Co-committed-by: Antigravity <antigravity@google.com>

src/NexusReader.Web/Program.cs

@@ -7,6 +7,7 @@ using NexusReader.Application.Abstractions.Services;
 using NexusReader.Application.Queries.User;
 using NexusReader.Application.Commands.Library;
 using NexusReader.Application.Queries.Library;
+using NexusReader.Application.Queries.Concepts;
 using MediatR;
 using NexusReader.Web.Client.Services;
 using NexusReader.UI.Shared.Services;
@@ -73,6 +74,7 @@ builder.Services.AddHttpClient("NexusAPI", (sp, client) =>
 builder.Services.AddScoped(sp => sp.GetRequiredService<IHttpClientFactory>().CreateClient("NexusAPI"));
 
 builder.Services.AddScoped<IIdentityService, NexusReader.Web.Services.ServerIdentityService>();
+builder.Services.AddScoped<IConceptsMapService, NexusReader.Web.Services.ServerConceptsMapService>();
 builder.Services.AddCascadingAuthenticationState();
 
 builder.Services.AddApplication();
@@ -86,6 +88,11 @@ builder.Services.AddMediatR(cfg => cfg.RegisterServicesFromAssemblies(
 // Authorization Policies
 builder.Services.AddScoped<IAuthorizationHandler, TokenLimitHandler>();
 builder.Services.AddAuthorizationBuilder()
+    .SetDefaultPolicy(new Microsoft.AspNetCore.Authorization.AuthorizationPolicyBuilder(
+        IdentityConstants.ApplicationScheme,
+        IdentityConstants.BearerScheme)
+        .RequireAuthenticatedUser()
+        .Build())
     .AddPolicy("ProUser", policy => policy.RequireClaim("Plan", SubscriptionPlan.ProName, SubscriptionPlan.EnterpriseName))
     .AddPolicy("HasAvailableTokens", policy => policy.AddRequirements(new TokenLimitRequirement()));
 
@@ -369,6 +376,28 @@ app.MapGet("/api/library/books", async (ClaimsPrincipal user, IMediator mediator
     return Results.BadRequest(errorMsg);
 }).RequireAuthorization();
 
+app.MapGet("/api/book/{bookId:guid}/concepts-map", async (
+    Guid bookId,
+    ClaimsPrincipal user,
+    IMediator mediator) =>
+{
+    var userId = user.FindFirstValue(ClaimTypes.NameIdentifier);
+    var tenantId = user.FindFirstValue("TenantId") ?? "global";
+
+    if (string.IsNullOrEmpty(userId))
+    {
+        return Results.Unauthorized();
+    }
+
+    var result = await mediator.Send(new GetBookConceptsMapQuery(bookId, userId, tenantId));
+    if (result.IsFailed)
+    {
+        return Results.BadRequest(result.Errors.FirstOrDefault()?.Message ?? "Failed to fetch concepts map.");
+    }
+
+    return Results.Ok(result.Value);
+}).RequireAuthorization();
+
 app.MapPost("/api/StripeWebhook", async (
     HttpContext context, 
     UserManager<NexusUser> userManager, 

src/NexusReader.Web/Services/ServerConceptsMapService.cs

@@ -0,0 +1,49 @@
+using System.Security.Claims;
+using FluentResults;
+using MediatR;
+using NexusReader.Application.Abstractions.Services;
+using NexusReader.Application.Queries.Concepts;
+
+namespace NexusReader.Web.Services;
+
+public class ServerConceptsMapService : IConceptsMapService
+{
+    private readonly IMediator _mediator;
+    private readonly IIdentityService _identityService;
+
+    public ServerConceptsMapService(
+        IMediator mediator,
+        IIdentityService identityService)
+    {
+        _mediator = mediator;
+        _identityService = identityService;
+    }
+
+    public async Task<Result<BookConceptsMapResultDto>> GetConceptsMapAsync(Guid bookId)
+    {
+        try
+        {
+            var profileResult = await _identityService.GetProfileAsync();
+
+            if (profileResult.IsFailed)
+            {
+                return Result.Fail<BookConceptsMapResultDto>("Użytkownik nie jest uwierzytelniony.");
+            }
+
+            var profile = profileResult.Value;
+            var userId = profile.UserId;
+            var tenantId = profile.TenantId.ToString();
+
+            if (string.IsNullOrEmpty(userId))
+            {
+                return Result.Fail<BookConceptsMapResultDto>("Nie znaleziono identyfikatora użytkownika.");
+            }
+
+            return await _mediator.Send(new GetBookConceptsMapQuery(bookId, userId, tenantId));
+        }
+        catch (Exception ex)
+        {
+            return Result.Fail<BookConceptsMapResultDto>(new Error("Błąd pobierania mapy pojęć na serwerze.").CausedBy(ex));
+        }
+    }
+}

src/NexusReader.Web/Services/ServerIdentityService.cs

@@ -9,6 +9,7 @@ using NexusReader.Application.Queries.User;
 using MediatR;
 using NexusReader.Application.Constants;
 using NexusReader.Application.Abstractions.Services;
+using Microsoft.AspNetCore.Components.Authorization;
 
 namespace NexusReader.Web.Services;
 
@@ -19,6 +20,7 @@ public class ServerIdentityService : IIdentityService
     private readonly IHttpContextAccessor _httpContextAccessor;
     private readonly IMediator _mediator;
     private readonly INativeStorageService _storageService;
+    private readonly AuthenticationStateProvider _authStateProvider;
 
     public event Func<Task>? OnStateInvalidated;
 
@@ -27,13 +29,15 @@ public class ServerIdentityService : IIdentityService
         SignInManager<NexusUser> signInManager,
         IHttpContextAccessor httpContextAccessor,
         IMediator mediator,
-        INativeStorageService storageService)
+        INativeStorageService storageService,
+        AuthenticationStateProvider authStateProvider)
     {
         _userManager = userManager;
         _signInManager = signInManager;
         _httpContextAccessor = httpContextAccessor;
         _mediator = mediator;
         _storageService = storageService;
+        _authStateProvider = authStateProvider;
     }
 
     public async Task<Result> LoginAsync(string email, string password, bool rememberMe = false) 
@@ -107,8 +111,15 @@ public class ServerIdentityService : IIdentityService
 
     public async Task<Result<UserProfileDto>> GetProfileAsync()
     {
-        var user = _httpContextAccessor.HttpContext?.User;
-        if (user == null || !user.Identity?.IsAuthenticated == true) return Result.Fail("Not authenticated.");
+        var authState = await _authStateProvider.GetAuthenticationStateAsync();
+        var user = authState.User;
+        
+        if (user == null || user.Identity?.IsAuthenticated != true)
+        {
+            user = _httpContextAccessor.HttpContext?.User;
+        }
+
+        if (user == null || user.Identity?.IsAuthenticated != true) return Result.Fail("Not authenticated.");
 
         var userId = user.FindFirstValue(ClaimTypes.NameIdentifier);
         if (userId == null) return Result.Fail("User ID not found.");