refactor: SOLID architecture — backend service layer + frontend V2 components

## Backend — Service Layer & Repository Refactoring

### Neue Services (21 neue Dateien)

**Interfaces & Implementierungen:**
- `IOpenClawGatewayClient` — Interface für OpenClawGatewayClient (DIP-Fix: DashboardController hing an konkreter Klasse)
- `IAgentConfigService` / `AgentConfigService` — Agent-Config-File-I/O aus AgentsController extrahiert
- `IProjectService` / `ProjectService` — Projekt-CRUD + Activity-Logging (SRP)
- `ITaskService` / `TaskService` — Task-State-Machine, Approve/Reject, Dashboard-Operationen (eliminiert Duplikation zwischen TasksController und DashboardController)
- `IDashboardService` / `DashboardService` — Queue-Aggregation, Priority-Normalisierung, Gateway-Delegation
- `IOperationsService` / `OperationsService` — Metriken-Berechnung aus OperationsController
- `ITeamService` / `TeamService` — IDENTITY.md-Lesen aus TeamController
- `IMemoryService` / `MemoryService` — File-I/O aus MemoryController
- `IIncidentService` / `IncidentService` — File-Parsing (Regex-Source-Generatoren) aus IncidentsController
- `IDocService` / `DocService` — Directory-Scan aus DocsController
- `ICalendarService` / `CalendarService` — Gateway-HTTP-Calls + Fallback-Daten aus CalendarController

### Repository-Fixes

**IUserRepository / UserRepository:**
- `SaveChangesAsync` entfernt (leaky abstraction — Caller sollten nie SaveChanges steuern)
- `RevokeTokenAsync(tokenHash)` — atomares Token-Revoke inkl. SaveChanges
- `RevokeFamilyAsync(familyId)` — Batch-Revoke einer Token-Familie inkl. SaveChanges
- `RemoveExpiredTokensAsync` speichert jetzt selbst (war vorher dependent auf nachfolgenden Save)

### AuthService-Fixes
- `GetUserAsync`: unnötiges `Task.Run` entfernt → direkt `_users.GetByIdAsync().AsTask()`
- `RevokeAsync`: delegiert jetzt an `IUserRepository.RevokeTokenAsync`
- `RefreshAsync`: Token-Reuse-Detection delegiert an `IUserRepository.RevokeFamilyAsync`

### Bug-Fix
- `OpenClawGatewayClient.ReadAgentGoalAsync`: pre-existing `CS1656` behoben (`reader` war `using`-Variable und wurde neu zugewiesen — in `reader2` umbenannt)

### Controller (16 Stück — alle slim)
Alle Controller reduziert auf: Input validieren → Service aufrufen → HTTP-Result zurückgeben.
Kein Business-Logic, kein File-I/O, keine direkte Repository-Nutzung (außer AgentsController für Activity-Log).

**Program.cs — neue Registrierungen:**
- `AddHttpClient<IOpenClawGatewayClient, OpenClawGatewayClient>` (war vorher konkrete Klasse)
- Scoped: IDashboardService, IProjectService, ITaskService, IOperationsService, ITeamService, ICalendarService
- Singleton: IAgentConfigService, IMemoryService, IIncidentService, IDocService

---

## Frontend — Dashboard V2 Components

**AgentDetailModal.vue, IrisChat.vue, TaskStrip.vue:**
- V2 Design-System: Dark Space Theme, Glass-Panels, Gradient-Akzente
- Stores (agents, chat, tasks) nutzen Service + Mapper-Pattern
- NexusLayout, FlowBoard, Topbar — Layoutfixes für fullHeight-Route-Meta

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/Services/AgentConfigService.cs

@@ -0,0 +1,64 @@
+using Nexus.Api.Helpers;
+
+namespace Nexus.Api.Services;
+
+public sealed class AgentConfigService : IAgentConfigService
+{
+    private static readonly HashSet<string> AllowedFiles = new(StringComparer.OrdinalIgnoreCase)
+    {
+        "IDENTITY.md", "SOUL.md", "AGENTS.md", "TOOLS.md", "HEARTBEAT.md", "USER.md", "MEMORY.md"
+    };
+
+    public IReadOnlyList<AgentConfigFileInfo> GetConfigFiles(string agentId)
+    {
+        var workspacePath = $"/mnt/workspace-{agentId}";
+        if (!Directory.Exists(workspacePath))
+            return Array.Empty<AgentConfigFileInfo>();
+
+        return Directory.GetFiles(workspacePath, "*.md")
+            .Select(f => new FileInfo(f))
+            .Where(f => AllowedFiles.Contains(f.Name))
+            .OrderBy(f => f.Name)
+            .Select(f => new AgentConfigFileInfo(f.Name, f.Length, f.LastWriteTimeUtc))
+            .ToList();
+    }
+
+    public async Task<AgentConfigFileContent?> GetConfigFileAsync(string agentId, string fileName, CancellationToken ct = default)
+    {
+        if (!PathSecurityHelper.IsValidConfigFileName(fileName))
+            return null;
+
+        var workspacePath = $"/mnt/workspace-{agentId}";
+        if (!PathSecurityHelper.TryResolveSafePath(workspacePath, fileName, out var safePath) || !File.Exists(safePath))
+            return null;
+
+        var content = await File.ReadAllTextAsync(safePath!, ct);
+        var fi = new FileInfo(safePath!);
+        return new AgentConfigFileContent(fileName, content, fi.Length, fi.LastWriteTimeUtc);
+    }
+
+    public async Task<AgentConfigFileSaveResult?> SaveConfigFileAsync(string agentId, string fileName, string content, CancellationToken ct = default)
+    {
+        if (!PathSecurityHelper.IsValidConfigFileName(fileName))
+            return null;
+
+        var workspacePath = $"/mnt/workspace-{agentId}";
+        if (!PathSecurityHelper.TryResolveSafePath(workspacePath, fileName, out var safePath))
+            return null;
+
+        var tempPath = safePath + ".tmp";
+        try
+        {
+            await File.WriteAllTextAsync(tempPath, content, ct);
+            File.Move(tempPath, safePath!, overwrite: true);
+        }
+        catch
+        {
+            if (File.Exists(tempPath)) File.Delete(tempPath);
+            throw;
+        }
+
+        var fi = new FileInfo(safePath!);
+        return new AgentConfigFileSaveResult(fileName, fi.Length, fi.LastWriteTimeUtc);
+    }
+}