refactor: major architecture improvements

Security:
- Remove exposed NocoDB token from client code
- Add .env.example for environment variables

Shared Components:
- Carousel: touch/keyboard navigation, accessibility
- ChartCard: reusable chart container
- EmptyState: for no-data scenarios
- FilterControls: collapsible filter panel with reset button
- StatCard: metric display with change indicator
- ToggleSwitch: accessible radio-style toggle

Architecture:
- Create src/config/chartConfig.js for shared chart options
- Extract ChartJS registration to single location
- Reduce code duplication in Dashboard and Comparison

UX Improvements:
- Add empty state when filters return no data
- Add Reset Filters button to filter controls
- Add skeleton loader CSS utilities
- Improve focus states for accessibility
- Use shared components in Dashboard and Comparison

src/services/dataService.js

@@ -3,15 +3,12 @@ const SPREADSHEET_ID = '1rdK1e7jmfu-es4Ql0YwDYNBY2OvVihBjYaXTM-MHHqg';
 const SHEET_NAME = 'Consolidated Data';
 const SHEET_URL = `https://docs.google.com/spreadsheets/d/${SPREADSHEET_ID}/gviz/tq?tqx=out:csv&sheet=${encodeURIComponent(SHEET_NAME)}`;
 
-// NocoDB configuration
-// Use relative URL for dev proxy, full URL for production
-const NOCODB_URL = process.env.NODE_ENV === 'production' ? 'http://localhost:8090' : '';
-const NOCODB_TOKEN = 'By-wCdkUm6N9JdfmNpGH2jd6LqEejwOXER7FMkgr';
+// NocoDB configuration - uses environment variables for security
+// Set REACT_APP_NOCODB_URL and REACT_APP_NOCODB_TOKEN in .env.local
+const NOCODB_URL = process.env.REACT_APP_NOCODB_URL || '';
+const NOCODB_TOKEN = process.env.REACT_APP_NOCODB_TOKEN || '';
 
-// Old flat table (for backwards compatibility)
-const NOCODB_TABLE_ID = 'mzcz8ktjybcjc79';
-
-// New normalized tables (Samaya Museums Statistics base)
+// Table IDs (not sensitive - just identifiers)
 const NOCODB_TABLES = {
   districts: 'm8cup7lesbet0sa',
   museums: 'm1c7od7mdirffvu',