feat: phases 77–80 — navbar view refresh, static background, API tokens, history suggestion chips

Single consolidated commit for four completed, validated phases (77, 78,
79, 80). The pipeline run left all work uncommitted because the harness
commits only with PHASE_COMMIT=1 while child executors are forbidden from
committing; the phases themselves all passed validation and moved to
.agents/phases/complete/.

Phase 77 — navbar view refresh
- router.js dispatches bor:view-refresh on re-show / active re-click /
  popstate (gated on wasMounted; first show and boot exempt)
- History / RAG / Sources / Tuning re-fetch on refresh (admin branch);
  Chat deliberately excluded (stream survival)
- History "Refresh" button (admin-only, in-flight disable + status line)
- New story suite tests/e2e/test_navbar_refresh.py (7 tests)

Phase 78 — static background
- Removed the animated glow layers; static 44px grid over the flat --bg
  canvas; default and reduced-motion renders byte-identical
- Updated background/theme E2E suites; removed bg-glow test pins

Phase 79 — API tokens
- api_tokens model + migration 0012; hash-only token service
- Admin tokens API + Tokens admin view; POST /api/token-auth;
  live-revoking require_user on chat / suggestions / document content
- Frontend token gate with localStorage cache; anonymous E2E suites
  migrated to token login
- New story suite tests/e2e/test_api_tokens.py (9 tests)

Phase 80 — history suggestion chips
- last_questions() endpoint with SEED fallback; startNewChat() refetch
- Seed-semantics docs (config.py, .env.example, README)
- Integration state matrix + E2E suite rewritten to the 4 chip states

Also included: phase-76 report artifacts and the repo restore-test-db
skill (previously untracked), scripts/* ruff fixes from phase 77.

Final gate state (phase 80 final pass, covers everything above):
- uv run pytest --cov=app → 1637 passed, 0 failed, app/ coverage 99%
- uv run ruff check . && uv run pyright → clean, 0 errors
- Per-phase story E2E suites green in isolation

app/models.py

@@ -41,6 +41,20 @@ Data model — see ``.agents/PLAN.md`` §Data Model:
                       ``commit_sha`` recorded) when the push endpoint
                       commits + pushes the file to the
                       ``BOR_DOCS_REPO`` branch (phase 59).
+* ``api_tokens``     — admin-issued access tokens: one row per
+                      generated token, so a person handed a token can
+                      sign in to use the app (chat, suggestion chips,
+                      cited documents) — the ONLY content that stays
+                      anonymous is the shared chats (phase 79).
+                      ``token_hash`` is the SHA-256 hex digest of the
+                      full ``bor_…`` token string (the stored
+                      credential — the plaintext exists only in the 201
+                      create response, returned exactly once);
+                      ``revoked_at`` set = dead (live-checked on the
+                      holder's next request), ``last_used_at`` bumped
+                      on ``POST /api/token-auth`` (task 03 — the only
+                      request that presents the token; the in-app gate
+                      re-sends the cached token on every page load).
 """
 from __future__ import annotations
 
@@ -314,3 +328,47 @@ class SavedChat(Base):
     updated_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True), server_default=func.now(), onupdate=func.now()
     )
+
+
+class ApiToken(Base):
+    """One admin-issued access token (phase 79, task 01).
+
+    The admin generates named tokens and hands them out so people can
+    sign in to the app and use it (chat, suggestion chips, cited
+    documents) — the ONLY content that stays anonymous is the shared chats
+    (extending the phase-16 single-admin auth; the ``require_user``
+    live-check and the admin token API land in tasks 02/03).
+
+    Trust model — the plaintext token (``bor_`` + 32 hex chars) exists
+    only in the 201 response of the create call, returned **exactly
+    once**; the row never carries it. The stored credential is the
+    SHA-256 hex digest of the **full** token string (``token_hash``):
+    hashing the full string, not the suffix, so a stripped prefix can
+    never collide. The ``saved_chats.share_token`` /
+    ``doc_drafts.token`` lineage — but HASHED: unlike those
+    unguessable ``uuid4`` link tokens these are long-lived hand-out
+    credentials, and a leaked database must not hand anyone working
+    tokens.
+    """
+
+    __tablename__ = "api_tokens"
+
+    id: Mapped[uuid.UUID] = mapped_column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
+    #: The hand-out name (e.g. "alice") — display-only: no index, not
+    #: unique (two tokens may share a label).
+    label: Mapped[str] = mapped_column(String(120), nullable=False)
+    #: The stored credential: the SHA-256 hex digest of the full
+    #: ``bor_…`` token string (the ``documents.content_hash``
+    #: String(64) precedent). Unique — the lookup is a unique-index hit
+    #: (``ix_api_tokens_token_hash`` — the explicit unique-index shape
+    #: of ``ix_saved_chats_share_token``, phase 51).
+    token_hash: Mapped[str] = mapped_column(String(64), unique=True, nullable=False)
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now())
+    #: Bumped to now() on ``POST /api/token-auth`` (task 03 calls the
+    #: service's ``mark_used`` and commits); NULL until the token is
+    #: first used.
+    last_used_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
+    #: Set on revocation (task 02) — the row is dead from that moment
+    #: (enforced immediately on the holder's next request); NULL while
+    #: active.
+    revoked_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)