feat(settings): hub auth-policy panel — T4/T5 security parity in the GUI

Settings → Security now shows the hub's effective auth policy via the
new read-only AuthStatus RPC: active token validator (static / jwt-rs256
with issuer, audience, JWKS source), anonymous-access warning, per-token
cards with scope grants, env-var presence and rate limits, plus a
localized admin-denied story for non-admin tokens. Live-reloads on
endpoint change.

Also fixes a batch of fai→chain rename leftovers this panel's
verification uncovered: hub_auth_token.dart and registry_token.dart
read/wrote ~/.fai/ while the hub reads ~/.chain/ (stored registry
tokens never reached the hub), today_story_loader + tools/today used
~/.fai/today, chain_log legacy ~/.fai/logs migration removed per the
no-legacy-recognisers decision, and UI strings still advertised the
retired .fai bundle extension.

Includes 5 widget tests for the panel, an integration-test screenshot
harness (auth_policy_shots_test.dart, guide-shots style), and DE+EN
l10n. flutter analyze clean, 58 tests green.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/data/registry_token.dart

@@ -9,17 +9,17 @@ import 'package:path/path.dart' as p;
 /// Studio writes the file directly so a fresh install never
 /// requires the operator to fiddle with shell env vars.
 class RegistryToken {
-  static String _faiHome() {
+  static String _chainHome() {
     final home =
         Platform.environment['HOME'] ?? Platform.environment['USERPROFILE'];
     if (home == null || home.isEmpty) {
       throw StateError('Cannot resolve home directory (no HOME / USERPROFILE)');
     }
-    return p.join(home, '.fai');
+    return p.join(home, '.chain');
   }
 
   /// Absolute path to the token file.
-  static String get path => p.join(_faiHome(), 'registry-token');
+  static String get path => p.join(_chainHome(), 'registry-token');
 
   /// True iff the file exists with a non-empty trimmed body.
   static Future<bool> isConfigured() async {