feat(rag): global tuning manager — /tuning.html + PUT /api/steering/{id}: create, edit, list, delete steering notes without a chat

tests/unit/test_shared_header.py

@@ -20,12 +20,14 @@ APP_JS = ASSETS / "app.js"
 SOURCES_JS = ASSETS / "sources.js"
 DOCUMENT_JS = ASSETS / "document.js"
 LOGIN_JS = ASSETS / "login.js"
+TUNING_JS = ASSETS / "tuning.js"
 STYLES_CSS = ASSETS / "styles.css"
 
 INDEX_HTML = FRONTEND / "index.html"
 SOURCES_HTML = FRONTEND / "sources.html"
 DOCUMENT_HTML = FRONTEND / "document.html"
 LOGIN_HTML = FRONTEND / "login.html"
+TUNING_HTML = FRONTEND / "tuning.html"
 
 
 def _text(path: Path) -> str:
@@ -74,7 +76,7 @@ def test_init_shared_header_toggles_only_elements_that_exist() -> None:
     assert fn != -1
     body = js[fn : js.find("\n}", fn)]
     assert "await fetchIsAdmin()" in body
-    for selector in ('#sign-in-link', '#sign-out-btn', '#nav-sources'):
+    for selector in ("#sign-in-link", "#sign-out-btn", "#nav-sources", "#nav-tuning"):
         assert f'querySelector("{selector}")' in body
     assert "return admin" in body, "callers may reuse the flag"
 
@@ -111,13 +113,32 @@ def test_nav_sources_ships_hidden_on_every_nav_page() -> None:
     nav link is hidden for anonymous — so it SHIPS with the hidden
     attribute (anonymous-safe default) on every page that has a nav
     (chat, sources, login)."""
-    for html in (INDEX_HTML, SOURCES_HTML, LOGIN_HTML):
+    for html in (INDEX_HTML, SOURCES_HTML, LOGIN_HTML, TUNING_HTML):
         text = _text(html)
         assert re.search(r'id="nav-sources"[^>]*\bhidden\b', text), (
             f"{html.name}: #nav-sources must ship hidden"
         )
 
 
+def test_nav_tuning_ships_hidden_on_the_tuning_page() -> None:
+    """Phase 27: the Global Tuning page reuses the shared header — the
+    "Tuning" nav link is admin-only, so it SHIPS hidden (revealed by
+    initSharedHeader once whoami says admin), is the page's active link
+    (is-active + aria-current), and the page loads markdown.js (classic)
+    + the tuning.js module with NO direct header.js <script> tag
+    (single-evaluation design)."""
+    text = _text(TUNING_HTML)
+    tag = re.search(r'<a[^>]*id="nav-tuning"[^>]*>', text)
+    assert tag, "tuning.html must carry the #nav-tuning nav link"
+    assert 'class="nav-link is-active"' in tag.group(0), "the Tuning link is the active one"
+    assert 'aria-current="page"' in tag.group(0)
+    assert "hidden" in tag.group(0), "#nav-tuning must ship hidden (admin-only)"
+    srcs = _script_srcs(TUNING_HTML)
+    assert [s for s in srcs if "header.js" in s] == [], "no direct header.js <script> tag"
+    assert [s for s in srcs if "markdown.js" in s]
+    assert [s for s in srcs if "tuning.js" in s]
+
+
 def test_nav_sources_is_absent_from_the_viewer() -> None:
     """The document viewer has no nav — no #nav-sources element there (the
     module's missing-element no-op keeps it out)."""
@@ -229,12 +250,12 @@ def test_login_js_uses_the_shared_fetch_is_admin() -> None:
 
 
 def test_non_chat_pages_bind_new_chat_to_the_chat_page() -> None:
-    """On sources and the viewer, New Chat means "go to the chat,
-    fresh": the binding clears the phase-14 key (clearChatStorage) and
-    navigates to "/" — and both pages run initSharedHeader() at boot
-    on the shared cached whoami. Phase 23: the import is relative
-    (`./header.js`)."""
-    for js_file in (SOURCES_JS, DOCUMENT_JS):
+    """On sources, the viewer, and the tuning page, New Chat means "go to
+    the chat, fresh": the binding clears the phase-14 key
+    (clearChatStorage) and navigates to "/" — and each page runs
+    initSharedHeader() at boot on the shared cached whoami. Phase 23:
+    the import is relative (`./header.js`)."""
+    for js_file in (SOURCES_JS, DOCUMENT_JS, TUNING_JS):
         js = _text(js_file)
         assert 'from "./header.js"' in js
         assert "initSharedHeader()" in js