feat(ui): shared header — Sign in/Sign out and New Chat on every page; hide the Sources nav link from anonymous users

frontend/document.html

@@ -21,6 +21,27 @@
         <h1 id="doc-title">Loading…</h1>
         <div id="doc-meta" class="doc-meta"></div>
       </div>
+      <!-- Phase 19: the shared header controls reach the viewer bar —
+           same markup, ids, and aria as the chat header (one consistent
+           bar on every page). The viewer has no nav, so no Sources link
+           here. header.js (assets/header.js) reveals exactly one of Sign in /
+           Sign out after whoami; New chat here means "go to the chat,
+           fresh" (document.js). The title block clips while the two
+           pills fit (.doc-header-actions, styles.css). -->
+      <div class="doc-header-actions">
+        <button type="button" class="new-chat-btn" id="new-chat-btn" aria-label="New chat">
+          <svg aria-hidden="true" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round"><path d="M12 5v14M5 12h14"/></svg>
+          <span class="new-chat-label">New chat</span>
+        </button>
+        <a href="/login.html?next=/document.html" class="auth-link" id="sign-in-link" hidden>
+          <svg aria-hidden="true" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round"><path d="M10 4h8a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2h-8"/><path d="M4 12h11"/><path d="m12 9 3 3-3 3"/></svg>
+          <span class="auth-label">Sign in</span>
+        </a>
+        <button type="button" class="auth-link" id="sign-out-btn" aria-label="Sign out" hidden>
+          <svg aria-hidden="true" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round"><path d="M14 4H6a2 2 0 0 0-2 2v12a2 2 0 0 0 2 2h8"/><path d="M9 12h11"/><path d="m17 9 3 3-3 3"/></svg>
+          <span class="auth-label">Sign out</span>
+        </button>
+      </div>
     </div>
   </header>
 
@@ -53,6 +74,10 @@
   </footer>
 
   <script src="assets/markdown.js"></script>
+  <!-- Phase 19: shared header module (whoami caching, Sign in/out,
+       sign-out binding) loads before the page script, which calls
+       initSharedHeader() at boot. -->
+  <script type="module" src="/assets/header.js"></script>
   <script type="module" src="assets/document.js"></script>
 </body>
 </html>