feat(ui): rename nav items — "Sources" becomes "RAG", "Git sources" becomes "Sources"

Owner request (2026-08-28): the two admin-only nav items read like the
same thing, so they are relabeled — the document-catalog link
(#nav-sources, /sources.html) becomes "RAG" and the source-manager link
(#nav-git-sources, /git-sources.html) becomes "Sources".

Phase 48 (48_nav_rename_sources), label-only per the locked decision:
- all six pages (index, sources, git-sources, tuning, document, login):
  the two <a> texts swap; ids, hrefs, hidden defaults, is-active /
  aria-current placement, and nav order (Chat, RAG, Sources, Tuning)
  are byte-unchanged otherwise.
- header.js: comment/docstring label mentions only — the reveal-by-id
  logic is untouched (ship-hidden/reveal contract intact).
- test_git_sources_admin.py / test_mobile_hamburger_nav.py: the two
  suites that asserted the old label text are updated; comment-only
  label fixes in test_shared_header.py / test_nav_consistency.py.
- tests/e2e/test_nav_rename_sources.py: the story E2E (green in
  isolation) — renamed labels + unchanged hrefs/order/markers on all
  six pages, click navigation with the active marker, the anonymous
  ship-hidden contract, and regression guards for the untouched
  controls (#sync-label "Sync sources", viewer #doc-back "Sources").
- All eight surrounding header/nav suites stay green in isolation;
  unit+integration green, app/ coverage 99% (frontend-only change),
  ruff + pyright clean.

Note: per this phase file-level staging, the six page files and
header.js also carry the same-day in-flight owner rework that was
already in the working tree when phase 48 ran (mobile sign-in dropdown
copy, sync button ship-hidden on the Sources page); the label rename
itself is the two-text swap on each page.

frontend/assets/header.js

@@ -6,8 +6,8 @@
  *
  *   • the Sign in / Sign out auth pair (phase 16, exactly one visible —
  *     decided by /api/whoami at load);
- *   • the admin-only nav links — "Sources" (#nav-sources, phase 19),
- *     "Git sources" (#nav-git-sources, phase 35) and "Tuning"
+ *   • the admin-only nav links — "RAG" (#nav-sources, phase 19),
+ *     "Sources" (#nav-git-sources, phase 35) and "Tuning"
  *     (#nav-tuning, phase 29) — phase 19 UX revision
  *     (owner permission 2026-08-23): hidden for anonymous on EVERY
  *     page, revealed for admin. Phase 34 task 03 (owner confirmation
@@ -106,17 +106,16 @@ export async function initSharedHeader() {
   // a query-safe "/…" string (never "//"; ? # and spaces stay
   // percent-encoded in it), so it rides in next= as-is — the same shape
   // the static fallbacks use (login.js safeNext re-validates it).
-  const signIn = document.querySelector("#sign-in-link");
-  if (signIn) {
-    signIn.hidden = admin;
-    signIn.href = "/login.html?next=" + (window.location.pathname || "/");
-  }
+  document.querySelectorAll(".sign-in-link").forEach(link => {
+    link.hidden = admin;
+    link.href = "/login.html?next=" + (window.location.pathname || "/");
+  });
   document.querySelectorAll(".sign-out-btn").forEach(btn => { btn.hidden = !admin; });
   const navSources = document.querySelector("#nav-sources");
   if (navSources) navSources.hidden = !admin;
-  // Phase 35 (owner permission 2026-08-26): the Git sources nav link —
+  // Phase 35 (owner permission 2026-08-26): the Sources nav link —
   // admin-only, the same ship-hidden / reveal-for-admin contract as
-  // the Sources link above.
+  // the RAG link above.
   const navGitSources = document.querySelector("#nav-git-sources");
   if (navGitSources) navGitSources.hidden = !admin;
   // Phase 29: the Global Tuning nav link (every page from phase 34