feat(sources): admin page to add and remove git sources (TODO.md L4)

frontend/assets/header.js

@@ -6,8 +6,9 @@
  *
  *   • the Sign in / Sign out auth pair (phase 16, exactly one visible —
  *     decided by /api/whoami at load);
- *   • the admin-only nav links — "Sources" (#nav-sources, phase 19)
- *     and "Tuning" (#nav-tuning, phase 29) — phase 19 UX revision
+ *   • the admin-only nav links — "Sources" (#nav-sources, phase 19),
+ *     "Git sources" (#nav-git-sources, phase 35) and "Tuning"
+ *     (#nav-tuning, phase 29) — phase 19 UX revision
  *     (owner permission 2026-08-23): hidden for anonymous on EVERY
  *     page, revealed for admin. Phase 34 task 03 (owner confirmation
  *     2026-08-26): the SAME nav ships on all five pages (chat,
@@ -109,6 +110,11 @@ export async function initSharedHeader() {
   if (signOut) signOut.hidden = !admin;
   const navSources = document.querySelector("#nav-sources");
   if (navSources) navSources.hidden = !admin;
+  // Phase 35 (owner permission 2026-08-26): the Git sources nav link —
+  // admin-only, the same ship-hidden / reveal-for-admin contract as
+  // the Sources link above.
+  const navGitSources = document.querySelector("#nav-git-sources");
+  if (navGitSources) navGitSources.hidden = !admin;
   // Phase 29: the Global Tuning nav link (every page from phase 34
   // task 03) — admin-only, the same ship-hidden / reveal-for-admin
   // contract as the Sources link.