feat: phases 77–80 — navbar view refresh, static background, API tokens, history suggestion chips

Single consolidated commit for four completed, validated phases (77, 78,
79, 80). The pipeline run left all work uncommitted because the harness
commits only with PHASE_COMMIT=1 while child executors are forbidden from
committing; the phases themselves all passed validation and moved to
.agents/phases/complete/.

Phase 77 — navbar view refresh
- router.js dispatches bor:view-refresh on re-show / active re-click /
  popstate (gated on wasMounted; first show and boot exempt)
- History / RAG / Sources / Tuning re-fetch on refresh (admin branch);
  Chat deliberately excluded (stream survival)
- History "Refresh" button (admin-only, in-flight disable + status line)
- New story suite tests/e2e/test_navbar_refresh.py (7 tests)

Phase 78 — static background
- Removed the animated glow layers; static 44px grid over the flat --bg
  canvas; default and reduced-motion renders byte-identical
- Updated background/theme E2E suites; removed bg-glow test pins

Phase 79 — API tokens
- api_tokens model + migration 0012; hash-only token service
- Admin tokens API + Tokens admin view; POST /api/token-auth;
  live-revoking require_user on chat / suggestions / document content
- Frontend token gate with localStorage cache; anonymous E2E suites
  migrated to token login
- New story suite tests/e2e/test_api_tokens.py (9 tests)

Phase 80 — history suggestion chips
- last_questions() endpoint with SEED fallback; startNewChat() refetch
- Seed-semantics docs (config.py, .env.example, README)
- Integration state matrix + E2E suite rewritten to the 4 chip states

Also included: phase-76 report artifacts and the repo restore-test-db
skill (previously untracked), scripts/* ruff fixes from phase 77.

Final gate state (phase 80 final pass, covers everything above):
- uv run pytest --cov=app → 1637 passed, 0 failed, app/ coverage 99%
- uv run ruff check . && uv run pyright → clean, 0 errors
- Per-phase story E2E suites green in isolation

tests/e2e/test_save_share_ux.py

@@ -12,10 +12,14 @@ Run in isolation (DB must be up: ``podman compose up -d db``):
 
     uv run pytest tests/e2e/test_save_share_ux.py -v --no-cov
 
-The owner-locked loop under test (2026-08-31):
+The owner-locked loop under test (2026-08-31). Phase 79 note: chat is
+now ``require_user``-gated (only shared chats stay open), so the
+"signed-out visitor" of the L3/L4 pins signs in first — the mechanism
+pins (no Save control, silent auto-save, exactly one row, share toast,
+unshare, layout) are unchanged.
 
-* **Anonymous auto-save (L4 / A2)** — there is NO Save control in the
-  DOM at any width; a signed-out visitor's first question auto-upserts
+* **Auto-save (L4 / A2)** — there is NO Save control in the
+  DOM at any width; the visitor's first question auto-upserts
   EXACTLY ONE ``saved_chats`` row (the auto-title, both messages) —
   verified through the admin's ``GET /api/chats`` (the management
   surface stays admin-only, phase 55 task 01) with no button press
@@ -253,9 +257,11 @@ def test_anonymous_auto_save(
     _reset_db(mock_llm, seed=True)
     page.set_default_timeout(30_000)
 
-    # Anonymous by construction: the page fixture's context never logs
-    # in — this is the signed-out visitor.
-    page.goto(app_url + "/")
+    # Phase 79: chat is require_user-gated — the phase-55 "signed-out
+    # visitor" no longer exists (shared chats are the only open
+    # surface), so the default visitor signs in first; every other pin
+    # (no Save control, silent auto-save, exactly one row) is unchanged.
+    login(page, app_url, next="/")
 
     # L4: there is NO Save control at any width — the element is gone
     # from the DOM (phase 55, task 02), the pills are New chat + Share.
@@ -300,7 +306,7 @@ def test_no_duplicate_row_across_reload(
     _reset_db(mock_llm, seed=True)
     page.set_default_timeout(30_000)
 
-    page.goto(app_url + "/")
+    login(page, app_url, next="/")  # phase 79: chat is require_user-gated
     q1 = "How is my Kubernetes cluster set up? (save-ux-reload)"
     _ask(page, q1)
 
@@ -350,11 +356,14 @@ def test_anonymous_share_toast_and_unshare(
     _reset_db(mock_llm, seed=True)
     page.set_default_timeout(30_000)
 
-    # Anonymous by construction — no login anywhere in this test.
-    page.goto(app_url + "/")
+    # Phase 79: the phase-55 "no login anywhere" visitor no longer
+    # exists (chat is gated) — the visitor signs in first; the FRESH
+    # incognito context below (the read-only shared view) stays
+    # anonymous, which is the open surface this story pins.
+    login(page, app_url, next="/")
 
-    # L3: the Share pill is visible WITHOUT login (static markup — the
-    # phase-51 admin-only reveal gate is gone, task 03).
+    # L3: the Share pill is visible (static markup — the phase-51
+    # admin-only reveal gate is gone, task 03).
     share = page.locator("#share-chat-btn")
     expect(share).to_be_visible()
     expect(share).to_have_attribute("aria-label", "Share chat")