Fix sidebar username, Signals filter clarity and layout

- JWT now carries a username claim; sidebar shows "Signed in as <name>"
  instead of the bare user id (sub). Re-login required for the new claim.
- Signals: Min R:R / Min Confidence inputs reflect the effective filter —
  auto-filled from the activation gate when "Qualified only" is on, reset
  to 0 when off (no more misleading 0 while the gate is active).
- Signals layout: Run Scanner moved to its own action row (it's a job
  trigger, not a filter); qualified toggle grouped with the refinement
  filters under one Filters panel.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

frontend/src/stores/authStore.ts

@@ -8,7 +8,7 @@ export interface AuthState {
   logout: () => void;
 }
 
-function decodeJwtPayload(token: string): { sub?: string; role?: string } {
+function decodeJwtPayload(token: string): { sub?: string; username?: string; role?: string } {
   try {
     const base64 = token.split('.')[1];
     const json = atob(base64);
@@ -23,7 +23,8 @@ export const useAuthStore = create<AuthState>()((set) => ({
   username: (() => {
     const t = localStorage.getItem('token');
     if (!t) return null;
-    return decodeJwtPayload(t).sub ?? null;
+    const p = decodeJwtPayload(t);
+    return p.username ?? p.sub ?? null;
   })(),
   role: (() => {
     const t = localStorage.getItem('token');
@@ -37,7 +38,7 @@ export const useAuthStore = create<AuthState>()((set) => ({
     localStorage.setItem('token', token);
     set({
       token,
-      username: payload.sub ?? null,
+      username: payload.username ?? payload.sub ?? null,
       role: payload.role === 'admin' ? 'admin' : 'user',
     });
   },