refactor: SOLID architecture — backend service layer + frontend V2 components

## Backend — Service Layer & Repository Refactoring

### Neue Services (21 neue Dateien)

**Interfaces & Implementierungen:**
- `IOpenClawGatewayClient` — Interface für OpenClawGatewayClient (DIP-Fix: DashboardController hing an konkreter Klasse)
- `IAgentConfigService` / `AgentConfigService` — Agent-Config-File-I/O aus AgentsController extrahiert
- `IProjectService` / `ProjectService` — Projekt-CRUD + Activity-Logging (SRP)
- `ITaskService` / `TaskService` — Task-State-Machine, Approve/Reject, Dashboard-Operationen (eliminiert Duplikation zwischen TasksController und DashboardController)
- `IDashboardService` / `DashboardService` — Queue-Aggregation, Priority-Normalisierung, Gateway-Delegation
- `IOperationsService` / `OperationsService` — Metriken-Berechnung aus OperationsController
- `ITeamService` / `TeamService` — IDENTITY.md-Lesen aus TeamController
- `IMemoryService` / `MemoryService` — File-I/O aus MemoryController
- `IIncidentService` / `IncidentService` — File-Parsing (Regex-Source-Generatoren) aus IncidentsController
- `IDocService` / `DocService` — Directory-Scan aus DocsController
- `ICalendarService` / `CalendarService` — Gateway-HTTP-Calls + Fallback-Daten aus CalendarController

### Repository-Fixes

**IUserRepository / UserRepository:**
- `SaveChangesAsync` entfernt (leaky abstraction — Caller sollten nie SaveChanges steuern)
- `RevokeTokenAsync(tokenHash)` — atomares Token-Revoke inkl. SaveChanges
- `RevokeFamilyAsync(familyId)` — Batch-Revoke einer Token-Familie inkl. SaveChanges
- `RemoveExpiredTokensAsync` speichert jetzt selbst (war vorher dependent auf nachfolgenden Save)

### AuthService-Fixes
- `GetUserAsync`: unnötiges `Task.Run` entfernt → direkt `_users.GetByIdAsync().AsTask()`
- `RevokeAsync`: delegiert jetzt an `IUserRepository.RevokeTokenAsync`
- `RefreshAsync`: Token-Reuse-Detection delegiert an `IUserRepository.RevokeFamilyAsync`

### Bug-Fix
- `OpenClawGatewayClient.ReadAgentGoalAsync`: pre-existing `CS1656` behoben (`reader` war `using`-Variable und wurde neu zugewiesen — in `reader2` umbenannt)

### Controller (16 Stück — alle slim)
Alle Controller reduziert auf: Input validieren → Service aufrufen → HTTP-Result zurückgeben.
Kein Business-Logic, kein File-I/O, keine direkte Repository-Nutzung (außer AgentsController für Activity-Log).

**Program.cs — neue Registrierungen:**
- `AddHttpClient<IOpenClawGatewayClient, OpenClawGatewayClient>` (war vorher konkrete Klasse)
- Scoped: IDashboardService, IProjectService, ITaskService, IOperationsService, ITeamService, ICalendarService
- Singleton: IAgentConfigService, IMemoryService, IIncidentService, IDocService

---

## Frontend — Dashboard V2 Components

**AgentDetailModal.vue, IrisChat.vue, TaskStrip.vue:**
- V2 Design-System: Dark Space Theme, Glass-Panels, Gradient-Akzente
- Stores (agents, chat, tasks) nutzen Service + Mapper-Pattern
- NexusLayout, FlowBoard, Topbar — Layoutfixes für fullHeight-Route-Meta

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/Controllers/IncidentsController.cs

@@ -1,100 +1,20 @@
 using Microsoft.AspNetCore.Mvc;
-using Nexus.Api.Helpers;
-using System.Text.RegularExpressions;
+using Nexus.Api.Services;
 
 namespace Nexus.Api.Controllers;
 
 [ApiController]
 [Route("api/v1/incidents")]
-public class IncidentsController : ControllerBase
+public class IncidentsController(IIncidentService incidentService) : ControllerBase
 {
     [HttpGet]
     public async Task<IResult> GetAll()
-    {
-        var basePath = "/mnt/workspace-iris/memory/incidents";
-        if (!Directory.Exists(basePath))
-            return Results.Ok(Array.Empty<object>());
-
-        var incidents = new List<object>();
-        foreach (var file in Directory.GetFiles(basePath, "*.md").OrderByDescending(f => f).Take(50))
-        {
-            var fi = new FileInfo(file);
-            if (fi.Length > 1_000_000) continue;
-            var name = Path.GetFileNameWithoutExtension(file);
-            var content = await System.IO.File.ReadAllTextAsync(file);
-
-            var title = name;
-            var titleMatch = Regex.Match(content, @"^#\s+(.+)$", RegexOptions.Multiline);
-            if (titleMatch.Success)
-                title = titleMatch.Groups[1].Value.Trim();
-
-            var date = (string?)null;
-            var dateMatch = Regex.Match(name, @"^(\d{4}-\d{2}-\d{2})");
-            if (dateMatch.Success)
-                date = dateMatch.Groups[1].Value;
-
-            var severity = "unknown";
-            var severityMatch = Regex.Match(content, @"\*\*Severity:\*\*\s*(.+)$", RegexOptions.Multiline);
-            if (severityMatch.Success)
-                severity = severityMatch.Groups[1].Value.Trim();
-
-            var excerptEnd = content.IndexOf("\n## ", StringComparison.Ordinal);
-            var excerpt = excerptEnd > 0
-                ? content[..excerptEnd].Trim()
-                : content[..Math.Min(300, content.Length)].Trim();
-            if (excerpt.Length > 200)
-                excerpt = excerpt[..200] + "\u2026";
-
-            incidents.Add(new
-            {
-                name = Path.GetFileName(file),
-                title,
-                date,
-                severity,
-                excerpt,
-                size = fi.Length
-            });
-        }
-
-        return Results.Ok(incidents);
-    }
+        => Results.Ok(await incidentService.GetAllAsync());
 
     [HttpGet("{name}")]
     public async Task<IResult> GetOne(string name)
     {
-        var basePath = "/mnt/workspace-iris/memory/incidents";
-        if (!PathSecurityHelper.TryResolveSafePath(basePath, name, out var filePath))
-            return Results.BadRequest("Invalid filename.");
-
-        if (!System.IO.File.Exists(filePath!))
-        {
-            if (!name.EndsWith(".md", StringComparison.OrdinalIgnoreCase))
-                filePath = Path.Combine(basePath, name + ".md");
-            if (!System.IO.File.Exists(filePath!))
-                return Results.NotFound();
-        }
-
-        var content = await System.IO.File.ReadAllTextAsync(filePath!);
-        var fi = new FileInfo(filePath!);
-        var fileName = Path.GetFileName(filePath!);
-
-        var title = fileName;
-        var titleMatch = Regex.Match(content, @"^#\s+(.+)$", RegexOptions.Multiline);
-        if (titleMatch.Success)
-            title = titleMatch.Groups[1].Value.Trim();
-
-        var date = (string?)null;
-        var dateMatch = Regex.Match(fileName, @"^(\d{4}-\d{2}-\d{2})");
-        if (dateMatch.Success)
-            date = dateMatch.Groups[1].Value;
-
-        return Results.Ok(new
-        {
-            name = fileName,
-            title,
-            date,
-            content,
-            size = fi.Length
-        });
+        var incident = await incidentService.GetByNameAsync(name);
+        return incident is null ? Results.NotFound() : Results.Ok(incident);
     }
 }