feat(ui): shared header — Sign in/Sign out and New Chat on every page; hide the Sources nav link from anonymous users

frontend/index.html

@@ -19,7 +19,10 @@
       </span>
       <nav class="app-nav" aria-label="Primary">
         <a href="/" class="nav-link is-active" aria-current="page">Chat</a>
-        <a href="/sources.html" class="nav-link">Sources</a>
+        <!-- Phase 19: the Sources link is admin-only (owner permission
+             2026-08-23) — hidden by default, header.js reveals it once
+             whoami says admin. The soft-gated page itself is unchanged. -->
+        <a href="/sources.html" class="nav-link" id="nav-sources" hidden>Sources</a>
       </nav>
       <!-- Phase 15: open the tuning-notes panel (stored in Postgres, read
            into every system prompt) — chat page only. -->
@@ -110,6 +113,10 @@
   </footer>
 
   <script src="assets/markdown.js"></script>
+  <!-- Phase 19: shared header module (whoami caching, Sign in/out,
+       Sources-link toggle, sign-out binding) loads before the page
+       script, which calls initSharedHeader() at boot. -->
+  <script type="module" src="/assets/header.js"></script>
   <script type="module" src="/assets/app.js"></script>
 </body>
 </html>