feat(ui): shared header — Sign in/Sign out and New Chat on every page; hide the Sources nav link from anonymous users

frontend/sources.html

@@ -19,8 +19,28 @@
       </span>
       <nav class="app-nav" aria-label="Primary">
         <a href="/" class="nav-link">Chat</a>
-        <a href="/sources.html" class="nav-link is-active" aria-current="page">Sources</a>
+        <!-- Phase 19: the Sources link is admin-only (owner permission
+             2026-08-23) — hidden by default, header.js reveals it once
+             whoami says admin. The soft-gated page itself is unchanged. -->
+        <a href="/sources.html" class="nav-link is-active" aria-current="page" id="nav-sources" hidden>Sources</a>
       </nav>
+      <!-- Phase 19: the shared header controls reach the Sources page —
+           same markup, ids, and aria as the chat header (one consistent
+           bar on every page). header.js (assets/header.js) reveals
+           exactly one of Sign in / Sign out after whoami; the New chat
+           button here means "go to the chat, fresh" (sources.js). -->
+      <button type="button" class="new-chat-btn" id="new-chat-btn" aria-label="New chat">
+        <svg aria-hidden="true" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round"><path d="M12 5v14M5 12h14"/></svg>
+        <span class="new-chat-label">New chat</span>
+      </button>
+      <a href="/login.html?next=/sources.html" class="auth-link" id="sign-in-link" hidden>
+        <svg aria-hidden="true" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round"><path d="M10 4h8a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2h-8"/><path d="M4 12h11"/><path d="m12 9 3 3-3 3"/></svg>
+        <span class="auth-label">Sign in</span>
+      </a>
+      <button type="button" class="auth-link" id="sign-out-btn" aria-label="Sign out" hidden>
+        <svg aria-hidden="true" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round"><path d="M14 4H6a2 2 0 0 0-2 2v12a2 2 0 0 0 2 2h8"/><path d="M9 12h11"/><path d="m17 9 3 3-3 3"/></svg>
+        <span class="auth-label">Sign out</span>
+      </button>
     </div>
   </header>
 
@@ -99,6 +119,10 @@
     </div>
   </footer>
 
+  <!-- Phase 19: shared header module (whoami caching, Sign in/out,
+       Sources-link toggle, sign-out binding) loads before the page
+       script, which calls initSharedHeader() at boot. -->
+  <script type="module" src="/assets/header.js"></script>
   <script type="module" src="/assets/sources.js"></script>
 </body>
 </html>