feat(ui): one consistent navbar on every page (TODO.md L3)

frontend/index.html

@@ -19,32 +19,55 @@
       </span>
       <nav class="app-nav" aria-label="Primary">
         <a href="/" class="nav-link is-active" aria-current="page">Chat</a>
-        <!-- Phase 19: the Sources link is admin-only (owner permission
-             2026-08-23) — hidden by default, header.js reveals it once
-             whoami says admin. The soft-gated page itself is unchanged. -->
+        <!-- Phase 19 (now every page — phase 34, owner confirmation
+             2026-08-26): the Sources link is admin-only (owner
+             permission 2026-08-23) — hidden by default, header.js
+             reveals it once whoami says admin. The soft-gated page
+             itself is unchanged. -->
         <a href="/sources.html" class="nav-link" id="nav-sources" hidden>Sources</a>
-        <!-- Phase 29: the Global Tuning link is admin-only (owner permission
-             2026-08-25) — hidden by default, header.js reveals it once
-             whoami says admin, exactly like the Sources link above. Points at
-             the standalone /tuning.html manager (phase 27). -->
+        <!-- Phase 29 (now every page — phase 34, owner confirmation
+             2026-08-26): the Global Tuning link is admin-only (owner
+             permission 2026-08-25) — hidden by default, header.js
+             reveals it once whoami says admin, exactly like the
+             Sources link above. -->
         <a href="/tuning.html" class="nav-link" id="nav-tuning" hidden>Tuning</a>
       </nav>
-      <!-- Phase 15: open the tuning-notes panel (stored in Postgres, read
-           into every system prompt) — chat page only. -->
+      <!-- Phase 15 (now every page — phase 34, owner confirmation
+           2026-08-26): open the tuning-notes panel (stored in
+           Postgres, read into every system prompt). The behavior is
+           owned by the shared header module (assets/header.js); the
+           #steering-panel section ships in every page's <main>. -->
       <button type="button" class="steering-toggle" id="steering-toggle"
               aria-expanded="false" aria-controls="steering-panel">
         <svg aria-hidden="true" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round"><path d="M4 7h10M18 7h2M4 17h4M12 17h8"/><circle cx="15.5" cy="7" r="2.2"/><circle cx="9.5" cy="17" r="2.2"/></svg>
         <span class="steering-label">Tuning</span>
         <span class="steering-count" id="steering-count">0</span>
       </button>
-      <!-- Phase 14: reset the local (localStorage) conversation — chat page only. -->
+      <!-- Phase 32 (now every page — phase 34, owner confirmation
+           2026-08-26): the admin-only "Sync sources" button — SHIPS
+           hidden (anonymous-safe), header.js reveals it for the admin
+           on the SAME cached whoami that reveals #nav-sources /
+           #nav-tuning. The §7.4 "never stale" lifecycle is
+           module-owned (assets/header.js); the Sources page's
+           #sync-result line + #sync-error-banner render off the
+           module's "bor:sync-status" event. -->
+      <button type="button" class="sync-btn" id="sync-btn" hidden aria-label="Sync sources">
+        <svg class="sync-icon" aria-hidden="true" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round"><path d="M21 12a9 9 0 1 1-9-9c2.52 0 4.93 1 6.74 2.74L21 8"/><path d="M21 3v5h-5"/></svg>
+        <span class="sync-label" id="sync-label">Sync sources</span>
+      </button>
+      <!-- Phase 14 (now every page — phase 34, owner confirmation
+           2026-08-26; module-owned since phase 34 task 02): on the
+           chat page "New chat" resets the local (localStorage)
+           conversation; on every other page it means "go to the
+           chat, fresh" (the module clears the key + navigates). -->
       <button type="button" class="new-chat-btn" id="new-chat-btn" aria-label="New chat">
         <svg aria-hidden="true" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round"><path d="M12 5v14M5 12h14"/></svg>
         <span class="new-chat-label">New chat</span>
       </button>
-      <!-- Phase 16: single-admin auth — exactly one of Sign in / Sign out
-           is visible; /api/whoami decides at load (app.js). Icon-only
-           below 640px (aria-labels keep the accessible names). -->
+      <!-- Phase 16: single-admin auth — exactly one of Sign in / Sign
+           out is visible; /api/whoami decides at load (the shared
+           header module). Icon-only below 640px (aria-labels keep the
+           accessible names). -->
       <a href="/login.html?next=/sources.html" class="auth-link" id="sign-in-link" hidden>
         <svg aria-hidden="true" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round"><path d="M10 4h8a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2h-8"/><path d="M4 12h11"/><path d="m12 9 3 3-3 3"/></svg>
         <span class="auth-label">Sign in</span>
@@ -63,7 +86,11 @@
         <span id="kb-banner-text"></span>
       </div>
 
-      <!-- Phase 15: tuning-notes panel (stored notes, newest first). -->
+      <!-- Phase 15 (now every page — phase 34, owner confirmation
+           2026-08-26): the tuning-notes panel (stored notes, newest
+           first) — rendered + driven by assets/header.js (shared), not
+           the page script. First child of <main> on the non-chat
+           pages; the chat page keeps it after #kb-banner. -->
       <section class="steering-panel" id="steering-panel" role="region"
                aria-label="Tuning notes" hidden>
         <div class="steering-panel-head">