feat: phases 77–80 — navbar view refresh, static background, API tokens, history suggestion chips

Single consolidated commit for four completed, validated phases (77, 78,
79, 80). The pipeline run left all work uncommitted because the harness
commits only with PHASE_COMMIT=1 while child executors are forbidden from
committing; the phases themselves all passed validation and moved to
.agents/phases/complete/.

Phase 77 — navbar view refresh
- router.js dispatches bor:view-refresh on re-show / active re-click /
  popstate (gated on wasMounted; first show and boot exempt)
- History / RAG / Sources / Tuning re-fetch on refresh (admin branch);
  Chat deliberately excluded (stream survival)
- History "Refresh" button (admin-only, in-flight disable + status line)
- New story suite tests/e2e/test_navbar_refresh.py (7 tests)

Phase 78 — static background
- Removed the animated glow layers; static 44px grid over the flat --bg
  canvas; default and reduced-motion renders byte-identical
- Updated background/theme E2E suites; removed bg-glow test pins

Phase 79 — API tokens
- api_tokens model + migration 0012; hash-only token service
- Admin tokens API + Tokens admin view; POST /api/token-auth;
  live-revoking require_user on chat / suggestions / document content
- Frontend token gate with localStorage cache; anonymous E2E suites
  migrated to token login
- New story suite tests/e2e/test_api_tokens.py (9 tests)

Phase 80 — history suggestion chips
- last_questions() endpoint with SEED fallback; startNewChat() refetch
- Seed-semantics docs (config.py, .env.example, README)
- Integration state matrix + E2E suite rewritten to the 4 chip states

Also included: phase-76 report artifacts and the repo restore-test-db
skill (previously untracked), scripts/* ruff fixes from phase 77.

Final gate state (phase 80 final pass, covers everything above):
- uv run pytest --cov=app → 1637 passed, 0 failed, app/ coverage 99%
- uv run ruff check . && uv run pyright → clean, 0 errors
- Per-phase story E2E suites green in isolation

tests/e2e/test_response_to_docs.py

@@ -72,7 +72,6 @@ from app.rag.llm import LLMClient
 from e2e.auth_helpers import login
 from e2e.conftest import (
     ADMIN_PASSWORD,
-    APP_PORT,
     SESSION_SECRET,
     USE_REAL_LLM,
     _wait_http,
@@ -81,6 +80,13 @@ from e2e.conftest import (
 REPO = Path(__file__).resolve().parents[2]
 FIXTURES = REPO / "tests" / "fixtures" / "docs"
 
+# Phase 79 (task 04, full inventory): the conftest session app owns its
+# port in a combined run — this module app (and the unconfigured one
+# next to it, derived below) bind their own ports instead (a same-port
+# second uvicorn dies on bind and would drive the wrong server).
+# Env-overridable.
+APP_PORT = int(os.environ.get("E2E_APP_PORT_DOCS", "8127"))
+
 APP_URL = f"http://127.0.0.1:{APP_PORT}"
 #: The unconfigured app's port (task 07: a second app boot WITHOUT
 #: ``BOR_DOCS_REPO`` — a separate fixture on the next port, so it can
@@ -352,9 +358,17 @@ def _stream_chat_answer(app_url: str, message: str) -> str:
     """Replay one turn through the raw SSE endpoint (the
     ``test_chat_rag.py`` transport pattern) and return the EXACT answer
     text — the markdown source the UI accumulates into ``m.text``,
-    byte-identical for the deterministic mock (same KB, same question)."""
+    byte-identical for the deterministic mock (same KB, same question).
+
+    Phase 79: POST /api/chat is require_user-gated — the replay client
+    signs in as the admin first (every caller of this helper is an
+    admin-flow test; the guest flow never reaches it)."""
+    client = httpx.Client(timeout=120.0)
+    r = client.post(f"{app_url}/api/login", json={"password": ADMIN_PASSWORD})
+    assert r.status_code == 204
+
     frames: list[dict[str, Any]] = []
-    with httpx.stream(
+    with client.stream(
         "POST", f"{app_url}/api/chat", json={"message": message}, timeout=120.0
     ) as r:
         assert r.status_code == 200
@@ -567,10 +581,14 @@ def test_guest_has_no_button(
 
     page.goto(app_url)
     expect(page.locator("#sign-in-link")).to_be_visible(timeout=30_000)
-    _ask(page, app_url, QUESTION_1)  # the grounded answer streams for guests too
 
-    # The "Save as doc" action is admin-only: ABSENT (not hidden) on
-    # the completed bubble, whatever the docs config says.
+    # Phase 79 (task 05): the guest meets the token gate — the composer
+    # is inert behind it, so the guest can never send a turn at all, and
+    # the admin-only Save-as-doc affordance (which renders only on
+    # completed brain bubbles) can never appear on their surface.
+    expect(page.locator("#auth-gate")).to_be_visible(timeout=15_000)
+    assert page.evaluate("() => document.getElementById('main').inert") is True
+    expect(page.locator(".msg.brain .bubble")).to_have_count(0)
     expect(page.locator(".save-as-doc-btn")).to_have_count(0)
 
     # The draft API 403s anonymous callers (httpx, no cookie at all).