fix(shell): daemon-start and health-poll auth handling; policy panel freshness

Review follow-ups on the auth-status work:

- Both daemon-start paths classified an auth-rejected hub as "daemon
  dead" via healthy() and showed a start-failure dialog while the
  shell banner above correctly blamed the token. They now share
  daemonAnswers(): only an unreachable probe counts as down.
- An auth-rejected poll now re-reads ~/.chain/hub-auth-token and
  reconnects when the file changed, so a token fixed outside Studio
  (CLI, editor) heals the connection without a restart — previously
  the client kept the stale in-memory token forever and the banner's
  own advice could not work.
- An endpoint switch resets the failure streak, so a stale in-flight
  probe can no longer let the unreachable banner blame the new
  endpoint for the old one's misses.
- The auth-policy panel re-queries when the hub token is saved or
  cleared in the panel above (reloadTick), instead of keeping a
  stale admin-denied hint; it also renders the hub's new
  reload_required flag as a pending-reload warning (DE+EN).
- today-pipeline.md still documented ~/.fai/today after the rename;
  the FAB theme comment now states the both-themes intent.

flutter analyze clean; 71 tests green including four new ones.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

test/hub_auth_policy_panel_test.dart

@@ -156,4 +156,54 @@ void main() {
     expect(find.textContaining('admin-Recht'), findsOneWidget);
     expect(find.text('Erneut versuchen'), findsOneWidget);
   });
+
+  testWidgets('reload-required policy shows the pending-reload hint', (
+    tester,
+  ) async {
+    await tester.pumpWidget(
+      _host(
+        HubAuthPolicyPanel(
+          loader: () async => const HubAuthPolicy(
+            validator: 'static',
+            anonymousAllowed: false,
+            tokens: [],
+            reloadRequired: true,
+          ),
+        ),
+      ),
+    );
+    await tester.pumpAndSettle();
+
+    expect(
+      find.textContaining('erzwingt noch den alten Stand'),
+      findsOneWidget,
+    );
+  });
+
+  testWidgets('a bumped reloadTick re-queries the policy', (tester) async {
+    var loads = 0;
+    Widget hostWithTick(int tick) => _host(
+      HubAuthPolicyPanel(
+        loader: () async {
+          loads++;
+          return _staticPolicy();
+        },
+        reloadTick: tick,
+      ),
+    );
+
+    await tester.pumpWidget(hostWithTick(0));
+    await tester.pumpAndSettle();
+    expect(loads, 1);
+
+    // Same tick: no reload on unrelated rebuilds.
+    await tester.pumpWidget(hostWithTick(0));
+    await tester.pumpAndSettle();
+    expect(loads, 1);
+
+    // Bumped tick (token saved next door): the panel re-queries.
+    await tester.pumpWidget(hostWithTick(1));
+    await tester.pumpAndSettle();
+    expect(loads, 2);
+  });
 }