fix(shell): daemon-start and health-poll auth handling; policy panel freshness

Review follow-ups on the auth-status work:

- Both daemon-start paths classified an auth-rejected hub as "daemon
  dead" via healthy() and showed a start-failure dialog while the
  shell banner above correctly blamed the token. They now share
  daemonAnswers(): only an unreachable probe counts as down.
- An auth-rejected poll now re-reads ~/.chain/hub-auth-token and
  reconnects when the file changed, so a token fixed outside Studio
  (CLI, editor) heals the connection without a restart — previously
  the client kept the stale in-memory token forever and the banner's
  own advice could not work.
- An endpoint switch resets the failure streak, so a stale in-flight
  probe can no longer let the unreachable banner blame the new
  endpoint for the old one's misses.
- The auth-policy panel re-queries when the hub token is saved or
  cleared in the panel above (reloadTick), instead of keeping a
  stale admin-denied hint; it also renders the hub's new
  reload_required flag as a pending-reload warning (DE+EN).
- today-pipeline.md still documented ~/.fai/today after the rename;
  the FAB theme comment now states the both-themes intent.

flutter analyze clean; 71 tests green including four new ones.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/data/hub.dart

@@ -162,6 +162,7 @@ class HubService {
         ? await HubAuthToken.read()
         : authToken as String?;
     _client = HubClient(endpoint: endpoint, authToken: token);
+    _lastAuthToken = token;
     if (persist) {
       final prefs = await SharedPreferences.getInstance();
       await prefs.setString(_kHostKey, endpoint.host);
@@ -177,6 +178,23 @@ class HubService {
     await reconnect(_client.endpoint);
   }
 
+  /// The token the live client was built with. The client caches it,
+  /// so an edit to `~/.chain/hub-auth-token` outside Studio is
+  /// invisible until a reconnect — see [reloadAuthTokenIfChanged].
+  String? _lastAuthToken;
+
+  /// Re-read the token file and reconnect ONLY when its content
+  /// differs from the token the live client uses. Returns whether a
+  /// reconnect happened. The shell's health poll calls this on an
+  /// auth-rejected probe so a token fixed outside Studio (CLI,
+  /// editor) heals the connection without a restart.
+  Future<bool> reloadAuthTokenIfChanged() async {
+    final fresh = await HubAuthToken.read();
+    if (fresh == _lastAuthToken) return false;
+    await reconnect(_client.endpoint, authToken: fresh, persist: false);
+    return true;
+  }
+
   static const _kThemeKey = 'theme.mode';
   static const _kLocaleKey = 'locale.code';
 
@@ -363,6 +381,7 @@ class HubService {
               scopeClaim: r.jwt.scopeClaim,
             )
           : null,
+      reloadRequired: r.reloadRequired,
     );
   }
 
@@ -1685,11 +1704,16 @@ class HubAuthPolicy {
   /// jwt-rs256 parameters; null for the static validator.
   final HubJwtValidatorInfo? jwt;
 
+  /// True when the on-disk auth config (or its env vars) no longer
+  /// matches the validator the hub enforces — a pending reload.
+  final bool reloadRequired;
+
   const HubAuthPolicy({
     required this.validator,
     required this.anonymousAllowed,
     required this.tokens,
     this.jwt,
+    this.reloadRequired = false,
   });
 }