feat(settings): hub auth-policy panel — T4/T5 security parity in the GUI

Settings → Security now shows the hub's effective auth policy via the
new read-only AuthStatus RPC: active token validator (static / jwt-rs256
with issuer, audience, JWKS source), anonymous-access warning, per-token
cards with scope grants, env-var presence and rate limits, plus a
localized admin-denied story for non-admin tokens. Live-reloads on
endpoint change.

Also fixes a batch of fai→chain rename leftovers this panel's
verification uncovered: hub_auth_token.dart and registry_token.dart
read/wrote ~/.fai/ while the hub reads ~/.chain/ (stored registry
tokens never reached the hub), today_story_loader + tools/today used
~/.fai/today, chain_log legacy ~/.fai/logs migration removed per the
no-legacy-recognisers decision, and UI strings still advertised the
retired .fai bundle extension.

Includes 5 widget tests for the panel, an integration-test screenshot
harness (auth_policy_shots_test.dart, guide-shots style), and DE+EN
l10n. flutter analyze clean, 58 tests green.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/data/chain_log.dart

@@ -51,31 +51,7 @@ class ChainLog {
         Platform.environment['HOME'] ??
         Platform.environment['USERPROFILE'] ??
         '.';
-    final path = p.join(home, '.chain', 'logs', 'studio-errors.log');
-    _migrateLegacyLog(home, path);
-    return path;
-  }
-
-  // Pre-rename installs wrote to `~/.fai/logs/`. Move that file (and
-  // its rotation sibling) over once so the error trail survives the
-  // rename; never overwrite an existing new-path file. Best-effort
-  // and cheap enough to run per access (two stat calls after the
-  // first migration).
-  static void _migrateLegacyLog(String home, String newPath) {
-    try {
-      for (final suffix in const ['', '.1']) {
-        final legacy = File(
-          p.join(home, '.fai', 'logs', 'studio-errors.log$suffix'),
-        );
-        final target = File('$newPath$suffix');
-        if (legacy.existsSync() && !target.existsSync()) {
-          target.parent.createSync(recursive: true);
-          legacy.renameSync(target.path);
-        }
-      }
-    } catch (_) {
-      // Best-effort: a failed migration must not break logging.
-    }
+    return p.join(home, '.chain', 'logs', 'studio-errors.log');
   }
 
   /// Absolute path of the studio-errors log. Public so the

lib/data/hub.dart

@@ -331,6 +331,42 @@ class HubService {
     );
   }
 
+  /// Read-only snapshot of the hub's authentication policy
+  /// (validator kind, anonymous flag, token entries with scope
+  /// grants and env-var set-state — never secret values). Feeds
+  /// Settings → Security. Admin-scoped on an auth-enabled hub.
+  Future<HubAuthPolicy> authStatus() async {
+    final r = await _client.authStatus();
+    return HubAuthPolicy(
+      validator: r.validator,
+      anonymousAllowed: r.anonymousAllowed,
+      tokens: r.tokens
+          .map(
+            (t) => HubAuthTokenEntry(
+              name: t.name,
+              tokenEnv: t.tokenEnv,
+              envSet: t.envSet,
+              scopes: List<String>.from(t.scopes),
+              rateLimitPerMinute: t.rateLimitPerMinute,
+            ),
+          )
+          .toList(),
+      jwt: r.hasJwt()
+          ? HubJwtValidatorInfo(
+              keySource: r.jwt.keySource,
+              audience: r.jwt.audience,
+              issuer: r.jwt.issuer,
+              scopeClaim: r.jwt.scopeClaim,
+            )
+          : null,
+    );
+  }
+
+  /// Re-read `auth.tokens:` from operator config + env vars and
+  /// swap the hub's live token store (rotation without restart).
+  /// Returns the new token count.
+  Future<int> reloadHubAuth() => _client.reloadAuth();
+
   /// Send a one-shot prompt to the System AI. Returns the
   /// answer + latency on success or an [AskAiResult] with
   /// `errorKind` set on failure (never throws). Studio maps
@@ -794,7 +830,7 @@ class HubService {
         .toList();
   }
 
-  /// Install a module from a `.fai` bundle (URL or local path).
+  /// Install a module from a `.chain` bundle (URL or local path).
   /// Returns the installed module's name + version on success;
   /// throws on hub error (signature mismatch, sha256 fail, etc.).
   Future<({String name, String version})> installModule({
@@ -1631,6 +1667,67 @@ class DetachedRun {
   }
 }
 
+/// Snapshot of the hub's authentication policy (AuthStatus RPC).
+/// Names + grants only — secret values never reach the client.
+class HubAuthPolicy {
+  /// "static" or "jwt-rs256".
+  final String validator;
+
+  /// True when the hub accepts anonymous calls (static validator
+  /// with an empty token list — the local-dev default).
+  final bool anonymousAllowed;
+  final List<HubAuthTokenEntry> tokens;
+
+  /// jwt-rs256 parameters; null for the static validator.
+  final HubJwtValidatorInfo? jwt;
+
+  const HubAuthPolicy({
+    required this.validator,
+    required this.anonymousAllowed,
+    required this.tokens,
+    this.jwt,
+  });
+}
+
+class HubAuthTokenEntry {
+  final String name;
+  final String tokenEnv;
+
+  /// Whether the env var is currently set in the daemon's
+  /// environment — the classic rotation footgun.
+  final bool envSet;
+
+  /// Scope grants verbatim (`read`, `execute`, `admin`, and
+  /// fine-grained patterns like `execute:llm.*`).
+  final List<String> scopes;
+
+  /// Requests per minute; 0 = unlimited.
+  final int rateLimitPerMinute;
+
+  const HubAuthTokenEntry({
+    required this.name,
+    required this.tokenEnv,
+    required this.envSet,
+    required this.scopes,
+    required this.rateLimitPerMinute,
+  });
+}
+
+class HubJwtValidatorInfo {
+  /// "inline-pem" or the configured public-key file path.
+  final String keySource;
+  final String audience;
+  final String issuer;
+  final String scopeClaim;
+
+  const HubJwtValidatorInfo({
+    required this.keySource,
+    required this.audience,
+    required this.issuer,
+    required this.scopeClaim,
+  });
+}
+
 class SystemAiStatus {
   final bool enabled;
   final String provider;

lib/data/hub_auth_token.dart

@@ -14,17 +14,17 @@ import 'package:path/path.dart' as p;
 /// anonymous mode; the hub then either accepts or rejects
 /// based on its own `auth.tokens:` config.
 class HubAuthToken {
-  static String _faiHome() {
+  static String _chainHome() {
     final home =
         Platform.environment['HOME'] ?? Platform.environment['USERPROFILE'];
     if (home == null || home.isEmpty) {
       throw StateError('Cannot resolve home directory (no HOME / USERPROFILE)');
     }
-    return p.join(home, '.fai');
+    return p.join(home, '.chain');
   }
 
   /// Absolute path to the token file.
-  static String get path => p.join(_faiHome(), 'hub-auth-token');
+  static String get path => p.join(_chainHome(), 'hub-auth-token');
 
   /// True iff the file exists with a non-empty trimmed body.
   static Future<bool> isConfigured() async {

lib/data/registry_token.dart

@@ -9,17 +9,17 @@ import 'package:path/path.dart' as p;
 /// Studio writes the file directly so a fresh install never
 /// requires the operator to fiddle with shell env vars.
 class RegistryToken {
-  static String _faiHome() {
+  static String _chainHome() {
     final home =
         Platform.environment['HOME'] ?? Platform.environment['USERPROFILE'];
     if (home == null || home.isEmpty) {
       throw StateError('Cannot resolve home directory (no HOME / USERPROFILE)');
     }
-    return p.join(home, '.fai');
+    return p.join(home, '.chain');
   }
 
   /// Absolute path to the token file.
-  static String get path => p.join(_faiHome(), 'registry-token');
+  static String get path => p.join(_chainHome(), 'registry-token');
 
   /// True iff the file exists with a non-empty trimmed body.
   static Future<bool> isConfigured() async {

lib/data/today_story_loader.dart

@@ -80,7 +80,7 @@ class TodayStoryLoader {
         Platform.environment['HOME'] ??
         Platform.environment['USERPROFILE'] ??
         '';
-    return p.join(home, '.fai', 'today', 'active.yaml');
+    return p.join(home, '.chain', 'today', 'active.yaml');
   }
 
   /// Reads and validates the active story. Returns `fallback`