feat(ui): one consistent navbar on every page (TODO.md L3)

frontend/assets/login.js

@@ -7,11 +7,12 @@
  * role=alert error region. On load, /api/whoami already says admin →
  * straight to `next`, no form.
  *
- * Phase 19: the whoami check runs on the shared header module's cached
- * promise (assets/header.js) — one request per page, and the module's
- * initSharedHeader() toggles the (admin-only) Sources nav link. The
- * login page carries no chat controls, so the module's missing-element
- * no-op keeps this page control-free.
+ * Phase 19 (phase 34 task 03, owner confirmation 2026-08-26): the
+ * whoami check runs on the shared header module's cached promise
+ * (assets/header.js) — one request per page, and the module's
+ * initSharedHeader() settles the login page's FULL shared header —
+ * the SAME bar as every other page (nav incl. the admin-only links,
+ * Tuning toggle, Sync, New chat, the auth pair).
  *
  * No CDN, no state in this file: the signed cookie is the whole session.
  * All DOM ids match frontend/login.html.
@@ -76,15 +77,20 @@ form.addEventListener("submit", async (e) => {
   }
 });
 
-/* Already the admin? Skip the form and go straight to the target.
- * (For anonymous visitors, initSharedHeader toggles the Sources nav
- * link — the only shared control this page carries; for the signed-in
- * case the redirect above makes the toggle moot.) */
+/* The bar settles in BOTH branches (phase 34 task 05 — the login page
+ * carries the FULL shared header, so a signed-in admin who lands here
+ * gets the settled admin bar for the frame before the redirect, not
+ * the ship-hidden state): the whoami promise is already settled by
+ * this point, so initSharedHeader adds no request and no delay, and
+ * the phase-16 redirect itself is unchanged. For anonymous visitors it
+ * settles the reduced bar: Sign in visible, the admin-only controls
+ * stay hidden, the steering toggle + panel removed. */
 (async () => {
-  if (await alreadySignedIn()) {
+  const admin = await alreadySignedIn();
+  await initSharedHeader();
+  if (admin) {
     window.location.replace(safeNext());
     return;
   }
-  await initSharedHeader(); // phase 19: Sources link toggle (no chat controls here)
   passwordInput.focus();
 })();