Skip /js/ in the Access Gate and set denied-page CSP so Denied UI can render.

Co-authored-by: Cursor <cursoragent@cursor.com>

example_test.go

@@ -71,7 +71,6 @@ func ExampleAccessGate_Wrap() {
 	inner := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		_, _ = io.WriteString(w, "ok")
 	})
-	// Empty Required Groups: gate is inactive.
 	h := gonexapp.AccessGate{}.Wrap(inner)
 
 	rec := httptest.NewRecorder()
@@ -87,3 +86,11 @@ func ExampleResolveRequiredGroups() {
 	// []
 	// 0
 }
+
+func ExampleTopMenuAdminRequired() {
+	fmt.Println(gonexapp.TopMenuAdminRequired("0", gonexapp.DefaultTopMenuAdminRequired))
+	fmt.Println(gonexapp.TopMenuAdminRequired("maybe", gonexapp.DefaultTopMenuAdminRequired))
+	// Output:
+	// 0
+	// 1
+}