feat(sources): removing a source deletes its files and index entries behind a confirmation modal

frontend/git-sources.html

@@ -229,19 +229,67 @@
              active list comes from. -->
         <p class="git-sources-empty" id="git-sources-empty" hidden>No sources stored yet.</p>
 
-        <!-- Scope boundary (phase locked decision): adding/removing a
-             source does NOT clone or prune — the Sync button performs
-             that; the phase-49 upload is the exception (it unpacks and
-             scans in place, and a same-name re-upload replaces the
-             source in place). -->
+        <!-- Phase 69 (owner request 2026-09-02): removal is a TOTAL
+             removal — the row, the source's indexed documents, and —
+             for git clones and uploaded archives — the files on the
+             server's disk, all immediately (the confirmation modal
+             below spells it out; foreign local directories are never
+             touched). Adding still does not clone — the Sync button
+             mirrors the remaining sources (upstream file churn is
+             pruned on that run); the phase-49 upload is the
+             in-place exception (it unpacks and scans, and a
+             same-name re-upload replaces the source in place). -->
         <p class="git-source-hint" id="git-sources-hint" role="note">
+          Removing a source is a total removal, done immediately: its
+          entry, its indexed documents, and — for git clones and
+          uploaded archives — its files on the server's disk (the
+          confirmation modal spells out exactly what will be deleted;
+          files in your own local directories are never touched).
           Uploads unpack and scan immediately — re-uploading the same
           filename replaces that source in place (no new folder, no
-          duplicate row). The Sync button still imports the git
-          checkouts and local directories together (files removed from
-          a source are pruned) — removing a source prunes its documents
-          from the index on the next sync.
+          duplicate row). The Sync button still mirrors the remaining
+          sources (files removed upstream are pruned on that run).
         </p>
+
+        <!-- Phase 69 (owner request 2026-09-02): the remove
+             confirmation — a real in-app alertdialog (the native
+             confirm() retired): a row's Remove button opens it
+             (git-sources.js).
+             It names the source (#remove-confirm-source — ALWAYS
+             populated via textContent: URLs may embed user:pass@
+             credentials, the phase-32 masking discipline) and states
+             the full-removal policy. Focus lands on Cancel (the safe
+             default for a destructive action); Escape, the Cancel
+             button, and the dim backdrop all close as cancel (no
+             request — focus returns to the row's Remove button); only
+             "Remove source" sends the DELETE, in the §7.4 "Removing…"
+             in-flight state. The .doc-modal overlay contract: a fixed
+             full-viewport dim backdrop + a centered panel (no blur).
+             Static markup so the E2E suite gets stable selectors (the
+             #git-sources-hint / gate convention). -->
+        <div class="remove-confirm" id="remove-confirm-dialog" role="alertdialog"
+             aria-modal="true" aria-labelledby="remove-confirm-title"
+             aria-describedby="remove-confirm-copy" hidden>
+          <div class="remove-confirm-backdrop" aria-hidden="true"></div>
+          <div class="remove-confirm-panel">
+            <h2 class="remove-confirm-title" id="remove-confirm-title">Remove this source?</h2>
+            <code class="remove-confirm-source" id="remove-confirm-source"></code>
+            <p class="remove-confirm-copy" id="remove-confirm-copy">
+              This permanently removes the source entry, all of its
+              indexed documents from the knowledge base, and — for git
+              clones and uploaded archives — the files on the server's
+              disk. Files in your own local directories are never
+              touched. This cannot be undone.
+            </p>
+            <p class="remove-confirm-error" id="remove-confirm-error" role="alert" hidden></p>
+            <div class="remove-confirm-actions">
+              <button type="button" class="remove-confirm-btn remove-confirm-cancel"
+                      id="remove-confirm-cancel">Cancel</button>
+              <button type="button" class="remove-confirm-btn remove-confirm-remove"
+                      id="remove-confirm-remove">Remove source</button>
+            </div>
+          </div>
+        </div>
       </div>
       <!-- Polite live region: the screen-reader confirmation for list
            loads, adds, and removals (git-sources.js owns the text). -->