feat(ui): shared header — Sign in/Sign out and New Chat on every page; hide the Sources nav link from anonymous users

frontend/assets/document.js

@@ -15,8 +15,16 @@
  *
  * A missing document (unknown pair, missing params, network error) shows
  * the designed not-found card with a link back to the Sources page.
+ *
+ * Phase 19: the viewer joins the shared header (assets/header.js) — the
+ * whoami fetch is the module's cached promise (one request per page,
+ * shared with initSharedHeader's toggling), and the bar gains the New
+ * chat button: on a non-chat page "new chat" means going to the chat,
+ * fresh (clear the phase-14 conversation key, then navigate to "/").
  */
 
+import { clearChatStorage, fetchIsAdmin, initSharedHeader } from "/assets/header.js";
+
 const params = new URLSearchParams(window.location.search);
 const source = params.get("source") || "";
 const path = params.get("path") || "";
@@ -111,6 +119,27 @@ function showNotFound() {
   notFoundEl.hidden = false;
 }
 
+/* Phase 19: the shared header controls (Sign in / Sign out — exactly one
+ * visible) are toggled here; the viewer has no nav, so there is no
+ * #nav-sources for the module to touch. Independent of the doc fetch
+ * (its own IIFE — load() below never waits on it).
+ * (fetchIsAdmin is imported for parity with the other header consumers —
+ * the module's cached promise is the single whoami per page either way.) */
+(async () => {
+  await initSharedHeader();
+})();
+
+/* Phase 19: New chat on a non-chat page means "go to the chat, fresh":
+ * clear the phase-14 conversation key, then land on the chat page — its
+ * empty state, since the conversation is gone from storage. */
+const newChatBtn = document.querySelector("#new-chat-btn");
+if (newChatBtn) {
+  newChatBtn.addEventListener("click", () => {
+    clearChatStorage();
+    window.location.href = "/";
+  });
+}
+
 async function load() {
   try {
     if (!source || !path) {