fix(shell): daemon-start and health-poll auth handling; policy panel freshness

Review follow-ups on the auth-status work:

- Both daemon-start paths classified an auth-rejected hub as "daemon
  dead" via healthy() and showed a start-failure dialog while the
  shell banner above correctly blamed the token. They now share
  daemonAnswers(): only an unreachable probe counts as down.
- An auth-rejected poll now re-reads ~/.chain/hub-auth-token and
  reconnects when the file changed, so a token fixed outside Studio
  (CLI, editor) heals the connection without a restart — previously
  the client kept the stale in-memory token forever and the banner's
  own advice could not work.
- An endpoint switch resets the failure streak, so a stale in-flight
  probe can no longer let the unreachable banner blame the new
  endpoint for the old one's misses.
- The auth-policy panel re-queries when the hub token is saved or
  cleared in the panel above (reloadTick), instead of keeping a
  stale admin-denied hint; it also renders the hub's new
  reload_required flag as a pending-reload warning (DE+EN).
- today-pipeline.md still documented ~/.fai/today after the rename;
  the FAB theme comment now states the both-themes intent.

flutter analyze clean; 71 tests green including four new ones.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

docs/today-pipeline.md

@@ -24,11 +24,11 @@ feeds the accepted story straight into Studio without a code release.
 │  2. PROPOSER                tools/today/propose.sh                 │
 │     local System-AI (Ollama by default) drafts 3 story candidates  │
 │     using tools/today/prompt.template.md + the signal summary →    │
-│     ~/.fai/today/proposals/<ISO-DATE>-<n>.yaml                     │
+│     ~/.chain/today/proposals/<ISO-DATE>-<n>.yaml                     │
 │                                                                    │
 │  3. REVIEW + ACCEPT         tools/today/accept.sh <proposal-id>    │
 │     operator skims the proposal files, picks one (or none) →       │
-│     ~/.fai/today/active.yaml                                       │
+│     ~/.chain/today/active.yaml                                       │
 │                                                                    │
 │  4. STUDIO                  lib/pages/store.dart                   │
 │     Studio reads active.yaml at startup; falls back to the         │
@@ -43,7 +43,7 @@ agent (macOS), systemd timer (Linux), or `cron` — see
 
 ## Schema
 
-`~/.fai/today/active.yaml` (and every proposal file) follows this shape:
+`~/.chain/today/active.yaml` (and every proposal file) follows this shape:
 
 ```yaml
 schema: today/v1
@@ -111,6 +111,6 @@ The prompt template (`tools/today/prompt.template.md`) hard-encodes:
 - A/B-testing or click-through tracking — Ch∆In has no surveillance budget
   and no telemetry pipeline to feed it into.
 - Auto-publication to git (operator-curated boundary stays manual).
-- Hub-served stories. Studio reads `~/.fai/today/active.yaml` directly
+- Hub-served stories. Studio reads `~/.chain/today/active.yaml` directly
   for now; promoting this to a HubAdmin RPC is a Phase 1 question once
   multi-tenant Studio appears.