feat: phases 77–80 — navbar view refresh, static background, API tokens, history suggestion chips

Single consolidated commit for four completed, validated phases (77, 78,
79, 80). The pipeline run left all work uncommitted because the harness
commits only with PHASE_COMMIT=1 while child executors are forbidden from
committing; the phases themselves all passed validation and moved to
.agents/phases/complete/.

Phase 77 — navbar view refresh
- router.js dispatches bor:view-refresh on re-show / active re-click /
  popstate (gated on wasMounted; first show and boot exempt)
- History / RAG / Sources / Tuning re-fetch on refresh (admin branch);
  Chat deliberately excluded (stream survival)
- History "Refresh" button (admin-only, in-flight disable + status line)
- New story suite tests/e2e/test_navbar_refresh.py (7 tests)

Phase 78 — static background
- Removed the animated glow layers; static 44px grid over the flat --bg
  canvas; default and reduced-motion renders byte-identical
- Updated background/theme E2E suites; removed bg-glow test pins

Phase 79 — API tokens
- api_tokens model + migration 0012; hash-only token service
- Admin tokens API + Tokens admin view; POST /api/token-auth;
  live-revoking require_user on chat / suggestions / document content
- Frontend token gate with localStorage cache; anonymous E2E suites
  migrated to token login
- New story suite tests/e2e/test_api_tokens.py (9 tests)

Phase 80 — history suggestion chips
- last_questions() endpoint with SEED fallback; startNewChat() refetch
- Seed-semantics docs (config.py, .env.example, README)
- Integration state matrix + E2E suite rewritten to the 4 chip states

Also included: phase-76 report artifacts and the repo restore-test-db
skill (previously untracked), scripts/* ruff fixes from phase 77.

Final gate state (phase 80 final pass, covers everything above):
- uv run pytest --cov=app → 1637 passed, 0 failed, app/ coverage 99%
- uv run ruff check . && uv run pyright → clean, 0 errors
- Per-phase story E2E suites green in isolation

app/api/docs.py

@@ -19,7 +19,7 @@ from sqlalchemy import func, select
 from sqlalchemy.orm import Session
 
 from app.api.sync import _sanitize_error
-from app.core.auth import require_admin
+from app.core.auth import require_admin, require_user
 from app.db import get_db
 from app.models import Chunk, Document
 from app.rag.llm import EmbeddingError, LLMClient
@@ -42,11 +42,12 @@ def list_indexed_documents(
 ) -> DocList:
     """All indexed documents with per-document chunk counts.
 
-    Admin-only (phase 16 — the catalog is what the sign-in gates; the
-    document viewer itself stays public, see below). Anonymous callers
-    get 403 ``admin only`` and the Sources page renders its sign-in gate
-    instead. An empty list means the knowledge base has not been imported
-    yet — the Sources page renders its designed empty state in that case.
+    Admin-only (phase 16 — the catalog is what the admin sign-in gates;
+    the document viewer below is user-gated since phase 79, the shared
+    chats being the only anonymous surface). Anonymous callers get 403
+    ``admin only`` and the Sources page renders its sign-in gate instead.
+    An empty list means the knowledge base has not been imported yet —
+    the Sources page renders its designed empty state in that case.
     """
     rows = db.execute(
         select(
@@ -78,7 +79,10 @@ def list_indexed_documents(
 
 @router.get("/documents/content", response_model=DocContent)
 def get_document_content(
-    source: str, path: str, db: Session = Depends(get_db)  # noqa: B008
+    source: str,
+    path: str,
+    db: Session = Depends(get_db),  # noqa: B008
+    _user: None = Depends(require_user),  # noqa: B008  # phase 79: admin or live token
 ) -> DocContent:
     """Full content of one indexed document, looked up by ``(source, path)``.
 
@@ -86,10 +90,12 @@ def get_document_content(
     strings such as ``../../etc/passwd`` — are just non-existent rows and
     map to 404 ``{detail: "document not found"}``.
 
-    Deliberately PUBLIC for anonymous callers (phase 16 soft rule, owner
-    decision 2026-08-22): the *catalog* (``GET /api/docs``) is what the
-    sign-in gates, not the viewer — chat cites documents and anyone may
-    open a cited document by direct URL.
+    User-gated (phase 79 — SUPERSEDES the phase-16 "deliberately PUBLIC
+    (soft rule)" note, owner decision 2026-08-22): the viewer content is
+    token-or-admin like the rest of the app surface — chat cites
+    documents and a signed-in user (admin or token holder) opens a cited
+    document by direct URL. The ONLY anonymous content left is the
+    shared chats.
     """
     row = db.execute(
         select(Document, func.count(Chunk.id).label("chunks"))