phase: 121_git_source_tokens

**Phase 121 final verification pass — all green** (all 4 tasks already in `complete/`; verified, no defects found, no changes needed)

- Verified implementation vs phase design: migration `0021` (reversible, round-tripped via `alembic downgrade base` + `upgrade head` → head `0021`), `GitSource.token` column, `normalize_credential`/`clone_url_for`/`sanitize_url`, clone callers switched (`sync.py`, `import_docs.py`), masked token fields in add form + editor, `extra="forbid"` output shapes
- Tests: `uv run pytest` → 2662 passed, 0 failed (exit 0); `uv run pytest --cov=app --cov-report=term-missing` → TOTAL **99%** (≥90% gate)
- Lint/types: `uv run ruff check .` → All checks passed; `uv run pyright` → 0 errors, 0 warnings
- E2E in isolation: `uv run pytest tests/e2e/test_git_source_tokens.py -v --no-cov` → **4 passed**

Completion criteria:
1. Private repo (UI add or pasted embedded-token URL) clones with injected token; token absent from every API response, page text, title attr, and full HTML — **PASS** (integration raw-JSON assertions + E2E `_assert_token_nowhere`)
2. Legacy embedded-token rows still clone from stored URL; output sanitized — **PASS** (`test_sync_legacy_row_clones_with_original_stored_url`, `test_get_masks_legacy_embedded_token_row`, env-fallback masking)
3. Public/local sources byte-identical — **PASS** (verbatim-URL + no-userinfo-unchanged tests)
4. pytest / coverage / ruff / pyright — **PASS** (see above)
5. Commit + phase move — harness responsibility; task files already in `complete/`, changes left in working tree (no commit made, per protocol)

Notable: no deviations; DB left at head, functional. Next pending phase: **122_image_documents** (then 123_chat_image_questions).

frontend/assets/styles.css

@@ -2386,7 +2386,16 @@ details.thinking .thinking-text ul { margin: 0 0 0.5rem; }
 #archive-upload-form:focus-within { border-color: var(--brand); box-shadow: 0 0 0 3px var(--brand-soft), var(--shadow); }
 #git-source-form > label,
 #archive-upload-form > label { color: var(--ink); font-weight: 600; white-space: nowrap; }
-#git-source-url {
+/* Phase 121 (task 03): the form-label "optional" hint — the muted
+   ink-soft pair (5.1:1 on the label's surface, AA) at the label's
+   600 weight relaxed to 400 so the hint reads as secondary (it
+   qualifies the name, it is not the name); small, inline. */
+.field-hint { color: var(--ink-soft); font-weight: 400; font-size: 0.8rem; }
+/* #git-source-token (phase 121): the optional masked private-repo
+   credential — the URL input's treatment VERBATIM (mono, >=44px
+   target, brand focus); type=password masks the value in display. */
+#git-source-url,
+#git-source-token {
   flex: 1;
   min-width: 14rem;
   min-height: 44px;
@@ -2398,8 +2407,10 @@ details.thinking .thinking-text ul { margin: 0 0 0.5rem; }
   border-radius: var(--radius-sm);
   padding: 0.45rem 0.7rem;
 }
-#git-source-url::placeholder { color: var(--ink-soft); }
-#git-source-url:focus-visible { outline-offset: 0; border-color: var(--brand); }
+#git-source-url::placeholder,
+#git-source-token::placeholder { color: var(--ink-soft); }
+#git-source-url:focus-visible,
+#git-source-token:focus-visible { outline-offset: 0; border-color: var(--brand); }
 #git-source-add,
 #archive-upload-btn {
   display: inline-flex;
@@ -2802,6 +2813,26 @@ details.thinking .thinking-text ul { margin: 0 0 0.5rem; }
   resize: vertical;
 }
 
+/* Phase 121 (task 03): the editor's masked token field — the
+   textarea's box language (full panel width, --bg fill, the line
+   border, mono) at the 44px touch floor; the label's top margin keeps
+   the field pair off the textarea. type=password + autocomplete=off
+   live in the markup (a PAT is not a site credential — no browser
+   save offer); the focus ring is the global 3px outline rule. */
+.ignore-editor-token-label { margin-top: 0.9rem; }
+.ignore-editor-token {
+  display: block;
+  width: 100%;
+  min-height: 44px;
+  padding: 0.55rem 0.65rem;
+  font-family: var(--mono);
+  font-size: 0.85rem;
+  color: var(--ink);
+  background: var(--bg);
+  border: 1px solid var(--line);
+  border-radius: var(--radius-sm);
+}
+
 /* The in-dialog failure line (role=alert): the err pair (err-ink on
    err-bg 9.3:1, the err-line border) — the .remove-confirm-error
    language. */
@@ -4943,6 +4974,7 @@ details.thinking .thinking-text ul { margin: 0 0 0.5rem; }
   #git-source-form > label,
   #archive-upload-form > label { white-space: normal; }
   #git-source-url,
+  #git-source-token,
   #archive-upload-file { min-width: 0; }
   #git-source-add,
   #archive-upload-btn { width: 100%; }