Apply technical-light design system to the gateway dashboard

Restyles the Blazor dashboard onto a portable token-based theme so it
reads like an instrument panel: warm-paper background, hairline-ruled
panels, IBM Plex type, monospace tabular numerics, and status carried by
colour chips. Vendors theme.css + IBM Plex fonts, rewrites dashboard.css
as a thin token-driven view layer, and swaps the Bootstrap navbar and
status badges for the design-system app bar and chips.

Also includes pending API-key management, Galaxy hierarchy projection,
and constraint-enforcement work with their tests.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/MxGateway.IntegrationTests/DashboardLdapLiveTests.cs

@@ -0,0 +1,52 @@
+using System.Security.Claims;
+using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.Extensions.Options;
+using MxGateway.Server.Configuration;
+using MxGateway.Server.Dashboard;
+
+namespace MxGateway.IntegrationTests;
+
+public sealed class DashboardLdapLiveTests
+{
+    [LiveLdapFact]
+    [Trait("Category", "LiveLdap")]
+    public async Task AuthenticateAsync_AdminInGwAdminGroup_Succeeds()
+    {
+        DashboardAuthenticator authenticator = CreateAuthenticator();
+
+        DashboardAuthenticationResult result = await authenticator.AuthenticateAsync(
+            "admin",
+            "admin123",
+            CancellationToken.None);
+
+        Assert.True(result.Succeeded);
+        Assert.NotNull(result.Principal);
+        Assert.Equal("admin", result.Principal.FindFirst(ClaimTypes.NameIdentifier)?.Value);
+        Assert.Contains(result.Principal.Claims, claim =>
+            claim.Type == DashboardAuthenticationDefaults.LdapGroupClaimType
+            && claim.Value.Contains("GwAdmin", StringComparison.OrdinalIgnoreCase));
+    }
+
+    [LiveLdapFact]
+    [Trait("Category", "LiveLdap")]
+    public async Task AuthenticateAsync_ReadOnlyUserMissingGwAdminGroup_Fails()
+    {
+        DashboardAuthenticator authenticator = CreateAuthenticator();
+
+        DashboardAuthenticationResult result = await authenticator.AuthenticateAsync(
+            "readonly",
+            "readonly123",
+            CancellationToken.None);
+
+        Assert.False(result.Succeeded);
+        Assert.Null(result.Principal);
+        Assert.DoesNotContain("readonly123", result.FailureMessage, StringComparison.Ordinal);
+    }
+
+    private static DashboardAuthenticator CreateAuthenticator()
+    {
+        return new DashboardAuthenticator(
+            Options.Create(new GatewayOptions()),
+            NullLogger<DashboardAuthenticator>.Instance);
+    }
+}

src/MxGateway.IntegrationTests/LiveLdapFactAttribute.cs

@@ -0,0 +1,20 @@
+namespace MxGateway.IntegrationTests;
+
+public sealed class LiveLdapFactAttribute : FactAttribute
+{
+    public const string EnableVariableName = "MXGATEWAY_RUN_LIVE_LDAP_TESTS";
+
+    public LiveLdapFactAttribute()
+    {
+        if (!Enabled)
+        {
+            Skip = $"Set {EnableVariableName}=1 to run live LDAP tests.";
+        }
+    }
+
+    public static bool Enabled =>
+        string.Equals(
+            Environment.GetEnvironmentVariable(EnableVariableName),
+            "1",
+            StringComparison.Ordinal);
+}