feat(creator): overhaul Creator flow, editor duplication, and staging setup (#83)

This pull request completely overhauls the Creator editor flow, resolves the editor duplication race condition, aligns layout/styling themes in light and dark mode, and adds Docker staging setups.

### Key Changes
1. **Creator Flow Polish**: Redesigned the editor canvas to prevent double scrolling by delegating overflow to the editor canvas layer, updated styles to a premium aesthetic.
2. **Race Condition Prevention**: Resolved Crepe editor duplication when loading or switching chapters by tracking state via shared window maps (`window.editorCache`, `window.editorStates`) and checking `_lastInitializedEditorId` synchronously in Blazor.
3. **Theme Synchronization**: Integrated explicit theme initialization (`ThemeService.InitializeAsync()`) and anchored CSS isolation selectors to correctly sync with Light (Soft Sepia) and Deep Dark theme preferences.
4. **Staging Automation**: Created staging docker configurations with `--nexus-only` flag to allow iterative development without resetting PG/Neo4j database containers.

---------

Co-authored-by: Marek Jasiński <jasins.marek@gmail.com>
Reviewed-on: #83
Co-authored-by: Antigravity <antigravity@google.com>
Co-committed-by: Antigravity <antigravity@google.com>

tests/NexusReader.Application.Tests/Services/AutosaveEngineTests.cs

@@ -0,0 +1,61 @@
+using System.Text.Json;
+using FluentAssertions;
+using NexusReader.Application.Common;
+using NexusReader.Application.DTOs.Media;
+using Xunit;
+
+namespace NexusReader.Application.Tests.Services;
+
+public class AutosaveEngineTests
+{
+    [Fact]
+    public void SerializeAndDeserialize_LocalBackupEnvelope_Succeeds()
+    {
+        // Arrange
+        var envelope = new LocalBackupEnvelope
+        {
+            ChapterId = Guid.NewGuid(),
+            Timestamp = DateTime.UtcNow.AddMinutes(-10),
+            MarkdownContent = "# Hello Autosave"
+        };
+
+        // Act
+        var json = JsonSerializer.Serialize(envelope, AppJsonContext.Default.LocalBackupEnvelope);
+        var deserialized = JsonSerializer.Deserialize(json, AppJsonContext.Default.LocalBackupEnvelope);
+
+        // Assert
+        deserialized.Should().NotBeNull();
+        deserialized!.ChapterId.Should().Be(envelope.ChapterId);
+        deserialized.MarkdownContent.Should().Be(envelope.MarkdownContent);
+        // Truncate milliseconds to avoid precision discrepancies in text representation
+        deserialized.Timestamp.ToUniversalTime().Date.Should().Be(envelope.Timestamp.ToUniversalTime().Date);
+    }
+
+    [Fact]
+    public void SerializeAndDeserialize_AutosaveChapterRequest_Succeeds()
+    {
+        // Arrange
+        var request = new AutosaveChapterRequest("# Content to Autosave");
+
+        // Act
+        var json = JsonSerializer.Serialize(request, AppJsonContext.Default.AutosaveChapterRequest);
+        var deserialized = JsonSerializer.Deserialize(json, AppJsonContext.Default.AutosaveChapterRequest);
+
+        // Assert
+        deserialized.Should().NotBeNull();
+        deserialized!.MarkdownContent.Should().Be(request.MarkdownContent);
+    }
+
+    [Fact]
+    public void BackupEviction_CheckAgeLogic_EvictsCorrectly()
+    {
+        // Arrange
+        var now = DateTime.UtcNow;
+        var freshTimestamp = now.AddDays(-6);
+        var expiredTimestamp = now.AddDays(-8);
+
+        // Act & Assert
+        (now - freshTimestamp).TotalDays.Should().BeLessThanOrEqualTo(7.0);
+        (now - expiredTimestamp).TotalDays.Should().BeGreaterThan(7.0);
+    }
+}

tests/NexusReader.Application.Tests/Services/HtmlSanitizerServiceTests.cs

@@ -51,4 +51,20 @@ public class HtmlSanitizerServiceTests
         result.Should().NotContain("alert");
         result.Should().Contain("<img src=\"x\">");
     }
+
+    [Fact]
+    public void Sanitize_WithMarkdownCodeBlockContainingAngleBrackets_DoesNotStripAngleBrackets()
+    {
+        // Arrange
+        var service = new HtmlSanitizerService();
+        var input = "Here is some code:\n\n```csharp\nif (x < y && y > z) { Console.WriteLine(\"test\"); }\n```";
+
+        // Act
+        var result = service.Sanitize(input);
+
+        // Assert
+        result.Should().Contain("&lt;");
+        result.Should().Contain("&gt;");
+        result.Should().NotContain("<script>");
+    }
 }

tests/NexusReader.Application.Tests/Services/ValidateImageSignatureTests.cs

@@ -0,0 +1,118 @@
+using FluentAssertions;
+using Xunit;
+
+namespace NexusReader.Application.Tests.Services;
+
+public class ValidateImageSignatureTests
+{
+    [Fact]
+    public void Validate_PNG_WithCorrectSignature_ReturnsTrue()
+    {
+        // Arrange
+        byte[] pngBytes = [0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A];
+        string fileName = "image.png";
+
+        // Act
+        bool isValid = ImageValidator.ValidateImageSignature(pngBytes, fileName, out string contentType);
+
+        // Assert
+        isValid.Should().BeTrue();
+        contentType.Should().Be("image/png");
+    }
+
+    [Fact]
+    public void Validate_JPEG_WithCorrectSignature_ReturnsTrue()
+    {
+        // Arrange
+        byte[] jpegBytes = [0xFF, 0xD8, 0xFF, 0xE0, 0x00, 0x10, 0x4A, 0x46];
+        string fileName = "photo.jpg";
+
+        // Act
+        bool isValid = ImageValidator.ValidateImageSignature(jpegBytes, fileName, out string contentType);
+
+        // Assert
+        isValid.Should().BeTrue();
+        contentType.Should().Be("image/jpeg");
+    }
+
+    [Fact]
+    public void Validate_WEBP_WithCorrectSignature_ReturnsTrue()
+    {
+        // Arrange
+        byte[] webpBytes = [
+            0x52, 0x49, 0x46, 0x46, // RIFF
+            0x00, 0x00, 0x00, 0x00, // length
+            0x57, 0x45, 0x42, 0x50  // WEBP
+        ];
+        string fileName = "graphic.webp";
+
+        // Act
+        bool isValid = ImageValidator.ValidateImageSignature(webpBytes, fileName, out string contentType);
+
+        // Assert
+        isValid.Should().BeTrue();
+        contentType.Should().Be("image/webp");
+    }
+
+    [Fact]
+    public void Validate_GIF_WithCorrectSignature_ReturnsTrue()
+    {
+        // Arrange
+        byte[] gifBytes = [
+            0x47, 0x49, 0x46, 0x38, 0x39, 0x61, // GIF89a
+            0x01, 0x00, 0x01, 0x00
+        ];
+        string fileName = "animation.gif";
+
+        // Act
+        bool isValid = ImageValidator.ValidateImageSignature(gifBytes, fileName, out string contentType);
+
+        // Assert
+        isValid.Should().BeTrue();
+        contentType.Should().Be("image/gif");
+    }
+
+    [Fact]
+    public void Validate_WithMismatchingExtension_ReturnsFalse()
+    {
+        // Arrange: Valid PNG bytes but JPEG extension
+        byte[] pngBytes = [0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A];
+        string fileName = "spoofed.jpg";
+
+        // Act
+        bool isValid = ImageValidator.ValidateImageSignature(pngBytes, fileName, out string contentType);
+
+        // Assert
+        isValid.Should().BeFalse();
+    }
+
+    [Fact]
+    public void Validate_WithInvalidSignature_ReturnsFalse()
+    {
+        // Arrange: Plain text bytes but PNG extension
+        byte[] txtBytes = [0x48, 0x65, 0x6C, 0x6C, 0x6F, 0x20, 0x77, 0x6F]; // "Hello wo"
+        string fileName = "not_a_png.png";
+
+        // Act
+        bool isValid = ImageValidator.ValidateImageSignature(txtBytes, fileName, out string contentType);
+
+        // Assert
+        isValid.Should().BeFalse();
+        contentType.Should().BeEmpty();
+    }
+
+    [Fact]
+    public void Validate_WithShortBytes_ReturnsFalse()
+    {
+        // Arrange
+        byte[] shortBytes = [0x89, 0x50];
+        string fileName = "short.png";
+
+        // Act
+        bool isValid = ImageValidator.ValidateImageSignature(shortBytes, fileName, out string contentType);
+
+        // Assert
+        isValid.Should().BeFalse();
+        contentType.Should().BeEmpty();
+    }
+}