Harden application security and navigation

[gafapa]

Summary

• reorganize the primary navigation and improve onboarding and empty-state usability
• harden handoff validation, attendance scope handling, application locking, and the AI extension bridge
• update dependencies, deployment security headers, coverage enforcement, tests, and documentation

Why

The review identified incomplete payload validation, stale asynchronous responses, insufficient lockout handling, an outdated AI extension protocol, missing deployment headers, and missing coverage enforcement. The navigation and onboarding changes also make the main workflows easier to understand and use.

Validation

• npm run verify
• ESLint and TypeScript checks passed
• 199 tests passed
• production build passed with Vite 8.2.1
• dependency audit passed with no known vulnerabilities
• git diff --check passed