feat(centralui): MainLayout/NavMenu delegate to ZB.MOM.WW.Theme ThemeShell + kit nav

src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Layout/MainLayout.razor

@@ -1,26 +1,28 @@
 @inherits LayoutComponentBase
 
-<div class="d-flex flex-column flex-lg-row" style="min-height: 100vh;">
-    @* Hamburger toggle: visible only on viewports <lg.
-       Bootstrap collapse JS lives in bootstrap.bundle.min.js (loaded in App.razor). *@
-    <button class="btn btn-outline-secondary btn-sm d-lg-none m-2 align-self-start"
-            type="button"
-            data-bs-toggle="collapse"
-            data-bs-target="#sidebar-collapse"
-            aria-controls="sidebar-collapse"
-            aria-expanded="false"
-            aria-label="Toggle navigation">
-        &#9776;
-    </button>
-
-    <div class="collapse d-lg-block" id="sidebar-collapse">
+@* The side-rail chassis (brand bar + responsive hamburger) is the shared
+   ZB.MOM.WW.Theme ThemeShell. NavMenu fills the rail's <Nav> slot with the
+   policy-gated nav groups; the session/sign-out block fills <RailFooter>. *@
+<ThemeShell Product="ScadaBridge" Accent="#2f5fd0">
+    <Nav>
         <NavMenu />
-    </div>
-
-    <main class="flex-grow-1 p-3">
-        @Body
-    </main>
-</div>
+    </Nav>
+    <RailFooter>
+        <AuthorizeView>
+            <Authorized>
+                @* CentralUI-024: claim type resolved via JwtTokenService. *@
+                <span class="rail-user">@context.User.GetDisplayName()</span>
+                <form method="post" action="/auth/logout" data-enhance="false">
+                    @* CentralUI-017: logout is a state-changing POST and is
+                       CSRF-protected — the antiforgery token is required. *@
+                    <AntiforgeryToken />
+                    <button type="submit" class="rail-btn">Sign Out</button>
+                </form>
+            </Authorized>
+        </AuthorizeView>
+    </RailFooter>
+    <ChildContent>@Body</ChildContent>
+</ThemeShell>
 
 @* Global host for IDialogService. One instance per layout renders all confirm/prompt
    dialogs raised via IDialogService.ConfirmAsync / PromptAsync. *@