fix(shell): daemon-start and health-poll auth handling; policy panel freshness

Review follow-ups on the auth-status work:

- Both daemon-start paths classified an auth-rejected hub as "daemon
  dead" via healthy() and showed a start-failure dialog while the
  shell banner above correctly blamed the token. They now share
  daemonAnswers(): only an unreachable probe counts as down.
- An auth-rejected poll now re-reads ~/.chain/hub-auth-token and
  reconnects when the file changed, so a token fixed outside Studio
  (CLI, editor) heals the connection without a restart — previously
  the client kept the stale in-memory token forever and the banner's
  own advice could not work.
- An endpoint switch resets the failure streak, so a stale in-flight
  probe can no longer let the unreachable banner blame the new
  endpoint for the old one's misses.
- The auth-policy panel re-queries when the hub token is saved or
  cleared in the panel above (reloadTick), instead of keeping a
  stale admin-denied hint; it also renders the hub's new
  reload_required flag as a pending-reload warning (DE+EN).
- today-pipeline.md still documented ~/.fai/today after the rename;
  the FAB theme comment now states the both-themes intent.

flutter analyze clean; 71 tests green including four new ones.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/widgets/chain_settings_dialog.dart

@@ -64,6 +64,10 @@ class _FaiSettingsDialogState extends State<ChainSettingsDialog> {
   /// after save / clear; UI only ever sees the trimmed length.
   int? _hubAuthTokenChars;
 
+  /// Bumped whenever the hub auth token is saved or cleared so the
+  /// auth-policy panel below re-queries with the new credentials.
+  int _authPolicyReloadTick = 0;
+
   @override
   void initState() {
     super.initState();
@@ -95,6 +99,9 @@ class _FaiSettingsDialogState extends State<ChainSettingsDialog> {
       await HubService.instance.reloadAuthToken();
       await _loadHubAuthToken();
       if (!mounted) return;
+      // The connection's auth just changed — the policy panel below
+      // must re-query instead of keeping a stale admin-denied hint.
+      setState(() => _authPolicyReloadTick++);
       final l = AppLocalizations.of(context)!;
       ScaffoldMessenger.of(
         context,
@@ -111,6 +118,7 @@ class _FaiSettingsDialogState extends State<ChainSettingsDialog> {
       await HubService.instance.reloadAuthToken();
       await _loadHubAuthToken();
       if (!mounted) return;
+      setState(() => _authPolicyReloadTick++);
       final l = AppLocalizations.of(context)!;
       ScaffoldMessenger.of(
         context,
@@ -650,7 +658,7 @@ class _FaiSettingsDialogState extends State<ChainSettingsDialog> {
         onClear: _clearHubAuthToken,
       ),
       const SizedBox(height: ChainSpace.xl),
-      const HubAuthPolicyPanel(),
+      HubAuthPolicyPanel(reloadTick: _authPolicyReloadTick),
     ];
   }