feat(ui): rename nav items — "Sources" becomes "RAG", "Git sources" becomes "Sources"

Owner request (2026-08-28): the two admin-only nav items read like the
same thing, so they are relabeled — the document-catalog link
(#nav-sources, /sources.html) becomes "RAG" and the source-manager link
(#nav-git-sources, /git-sources.html) becomes "Sources".

Phase 48 (48_nav_rename_sources), label-only per the locked decision:
- all six pages (index, sources, git-sources, tuning, document, login):
  the two <a> texts swap; ids, hrefs, hidden defaults, is-active /
  aria-current placement, and nav order (Chat, RAG, Sources, Tuning)
  are byte-unchanged otherwise.
- header.js: comment/docstring label mentions only — the reveal-by-id
  logic is untouched (ship-hidden/reveal contract intact).
- test_git_sources_admin.py / test_mobile_hamburger_nav.py: the two
  suites that asserted the old label text are updated; comment-only
  label fixes in test_shared_header.py / test_nav_consistency.py.
- tests/e2e/test_nav_rename_sources.py: the story E2E (green in
  isolation) — renamed labels + unchanged hrefs/order/markers on all
  six pages, click navigation with the active marker, the anonymous
  ship-hidden contract, and regression guards for the untouched
  controls (#sync-label "Sync sources", viewer #doc-back "Sources").
- All eight surrounding header/nav suites stay green in isolation;
  unit+integration green, app/ coverage 99% (frontend-only change),
  ruff + pyright clean.

Note: per this phase file-level staging, the six page files and
header.js also carry the same-day in-flight owner rework that was
already in the working tree when phase 48 ran (mobile sign-in dropdown
copy, sync button ship-hidden on the Sources page); the label rename
itself is the two-text swap on each page.

frontend/index.html

@@ -31,18 +31,24 @@
              permission 2026-08-23) — hidden by default, header.js
              reveals it once whoami says admin. The soft-gated page
              itself is unchanged. -->
-        <a href="/sources.html" class="nav-link" id="nav-sources" hidden>Sources</a>
+        <a href="/sources.html" class="nav-link" id="nav-sources" hidden>RAG</a>
         <!-- Phase 35 (owner permission 2026-08-26): the Git sources
              link is admin-only — hidden by default, header.js
              reveals it once whoami says admin, exactly like the
              Sources link above. -->
-        <a href="/git-sources.html" class="nav-link" id="nav-git-sources" hidden>Git sources</a>
+        <a href="/git-sources.html" class="nav-link" id="nav-git-sources" hidden>Sources</a>
         <!-- Phase 29 (now every page — phase 34, owner confirmation
              2026-08-26): the Global Tuning link is admin-only (owner
              permission 2026-08-25) — hidden by default, header.js
              reveals it once whoami says admin, exactly like the
              Sources link above. -->
         <a href="/tuning.html" class="nav-link" id="nav-tuning" hidden>Tuning</a>
+        <!-- Phase 46 (mobile dropdown copy: sign-in — desktop bar copy is
+             outside the nav; see styles.css .sign-in-mobile rules). -->
+        <a href="/login.html?next=/" class="auth-link sign-in-link sign-in-mobile" id="sign-in-link-mobile" hidden>
+          <svg aria-hidden="true" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round"><path d="M10 4h8a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2h-8"/><path d="M4 12h11"/><path d="m12 9 3 3-3 3"/></svg>
+          <span class="auth-label">Sign in</span>
+        </a>
         <!-- Phase 46 (mobile dropdown copy — desktop bar copy is
              outside the nav; see styles.css .sign-out-mobile rules). -->
         <button type="button" class="auth-link sign-out-btn sign-out-mobile" id="sign-out-btn-mobile" aria-label="Sign out" hidden>
@@ -60,7 +66,7 @@
            out is visible; /api/whoami decides at load (the shared
            header module). Icon-only below 640px (aria-labels keep the
            accessible names). -->
-      <a href="/login.html?next=/sources.html" class="auth-link" id="sign-in-link" hidden>
+      <a href="/login.html?next=/sources.html" class="auth-link sign-in-link" id="sign-in-link" hidden>
         <svg aria-hidden="true" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round"><path d="M10 4h8a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2h-8"/><path d="M4 12h11"/><path d="m12 9 3 3-3 3"/></svg>
         <span class="auth-label">Sign in</span>
       </a>