feat(ui): shared header — Sign in/Sign out and New Chat on every page; hide the Sources nav link from anonymous users

frontend/assets/login.js

@@ -7,10 +7,18 @@
  * role=alert error region. On load, /api/whoami already says admin →
  * straight to `next`, no form.
  *
+ * Phase 19: the whoami check runs on the shared header module's cached
+ * promise (assets/header.js) — one request per page, and the module's
+ * initSharedHeader() toggles the (admin-only) Sources nav link. The
+ * login page carries no chat controls, so the module's missing-element
+ * no-op keeps this page control-free.
+ *
  * No CDN, no state in this file: the signed cookie is the whole session.
  * All DOM ids match frontend/login.html.
  */
 
+import { fetchIsAdmin, initSharedHeader } from "/assets/header.js";
+
 const form = document.querySelector("#login-form");
 const passwordInput = document.querySelector("#login-password");
 const submitBtn = document.querySelector("#login-submit");
@@ -33,14 +41,12 @@ function showError(message) {
   passwordInput.select();
 }
 
-async function alreadySignedIn() {
-  try {
-    const r = await fetch("/api/whoami");
-    if (!r.ok) return false;
-    return (await r.json()).authenticated === true;
-  } catch {
-    return false; // API unreachable: stay on the form — submit will explain
-  }
+/* Phase 19: the shared header module IS the whoami call site (cached
+ * promise, anonymous-safe) — same result as the private fetch it
+ * replaces: a network failure stays on the form (submit will explain).
+ */
+function alreadySignedIn() {
+  return fetchIsAdmin();
 }
 
 form.addEventListener("submit", async (e) => {
@@ -70,11 +76,15 @@ form.addEventListener("submit", async (e) => {
   }
 });
 
-/* Already the admin? Skip the form and go straight to the target. */
+/* Already the admin? Skip the form and go straight to the target.
+ * (For anonymous visitors, initSharedHeader toggles the Sources nav
+ * link — the only shared control this page carries; for the signed-in
+ * case the redirect above makes the toggle moot.) */
 (async () => {
   if (await alreadySignedIn()) {
     window.location.replace(safeNext());
     return;
   }
+  await initSharedHeader(); // phase 19: Sources link toggle (no chat controls here)
   passwordInput.focus();
 })();