feat(admin): one-click sources sync — admin-only button triggers git clone/pull + re-import + KB overview refresh with polled live status

frontend/assets/header.js

@@ -12,7 +12,10 @@
  *     every page that has a nav (chat, sources, tuning, login),
  *     revealed for admin. The links SHIP hidden in the HTML
  *     (anonymous-safe default — the phase-16 "absent, not hidden"
- *     spirit), so no anonymous user ever sees one for a frame;
+ *     spirit), so no anonymous user ever sees one for a frame; and the
+ *     Sources page's "Sync sources" button (#sync-btn, phase 32) —
+ *     the same ship-hidden / reveal-for-admin contract on the SAME
+ *     cached whoami (one fetch, no extra request);
  *   • the sign-out click binding (POST /api/logout → reload) — moved
  *     here from app.js so there is exactly one implementation;
  *   • clearChatStorage() — the phase-14 conversation key, for the
@@ -68,6 +71,10 @@ export async function initSharedHeader() {
   // same ship-hidden / reveal-for-admin contract as the Sources link.
   const navTuning = document.querySelector("#nav-tuning");
   if (navTuning) navTuning.hidden = !admin;
+  // Phase 32: the Sources page's "Sync sources" button — admin-only,
+  // revealed on this same cached whoami (anonymous users never see it).
+  const syncBtn = document.querySelector("#sync-btn");
+  if (syncBtn) syncBtn.hidden = !admin;
   return admin;
 }