feat(settings): hub auth-policy panel — T4/T5 security parity in the GUI

Settings → Security now shows the hub's effective auth policy via the
new read-only AuthStatus RPC: active token validator (static / jwt-rs256
with issuer, audience, JWKS source), anonymous-access warning, per-token
cards with scope grants, env-var presence and rate limits, plus a
localized admin-denied story for non-admin tokens. Live-reloads on
endpoint change.

Also fixes a batch of fai→chain rename leftovers this panel's
verification uncovered: hub_auth_token.dart and registry_token.dart
read/wrote ~/.fai/ while the hub reads ~/.chain/ (stored registry
tokens never reached the hub), today_story_loader + tools/today used
~/.fai/today, chain_log legacy ~/.fai/logs migration removed per the
no-legacy-recognisers decision, and UI strings still advertised the
retired .fai bundle extension.

Includes 5 widget tests for the panel, an integration-test screenshot
harness (auth_policy_shots_test.dart, guide-shots style), and DE+EN
l10n. flutter analyze clean, 58 tests green.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/l10n/app_en.arb

@@ -822,7 +822,7 @@
     }
   },
   "registryCredentialsHeader": "REGISTRY CREDENTIALS",
-  "registryCredentialsBlurb": "Token used to download .fai modules from a registry behind a signin wall (Forgejo, GitHub-private). Stored at ~/.chain/registry-token, mode 0600. The CHAIN_REGISTRY_TOKEN env var still wins when set.",
+  "registryCredentialsBlurb": "Token used to download .chain modules from a registry behind a signin wall (Forgejo, GitHub-private). Stored at ~/.chain/registry-token, mode 0600. The CHAIN_REGISTRY_TOKEN env var still wins when set.",
   "registryTokenStatusConfigured": "Configured ({chars} chars)",
   "@registryTokenStatusConfigured": {
     "placeholders": {
@@ -847,6 +847,29 @@
       }
     }
   },
+  "authPolicyHeader": "HUB ACCESS POLICY",
+  "authPolicyBlurb": "How the hub checks incoming calls: the active validator, the tokens and their scope grants. Secrets stay in environment variables — only their names appear here.",
+  "authPolicyValidatorStatic": "Validator: static token list",
+  "authPolicyValidatorJwt": "Validator: JWT (RS256) via an external identity provider",
+  "authPolicyAnonymous": "No tokens configured — the hub accepts anonymous calls. Fine for local work; configure tokens in ~/.chain/config.yaml for production.",
+  "authPolicyNeedsAdmin": "This view needs a token with the admin scope. Store it above under “Hub authentication” and reload.",
+  "authPolicyHubTooOld": "The connected hub does not know this view yet — it is older than Studio. Update the hub (chain update apply) and reload.",
+  "authPolicyRetry": "Retry",
+  "authPolicyReload": "Reload tokens",
+  "authPolicyReloadDone": "Reloaded — {n} tokens active.",
+  "@authPolicyReloadDone": {"placeholders": {"n": {"type": "int"}}},
+  "authPolicyEditHint": "The policy is edited in ~/.chain/config.yaml (auth: section). After a change or token rotation, reload here — the hub applies it without a restart.",
+  "authPolicyEnvSet": "Environment variable {env} is set",
+  "@authPolicyEnvSet": {"placeholders": {"env": {"type": "String"}}},
+  "authPolicyEnvMissing": "Environment variable {env} is MISSING — the token is unusable",
+  "@authPolicyEnvMissing": {"placeholders": {"env": {"type": "String"}}},
+  "authPolicyRateLimit": "{n}/min",
+  "@authPolicyRateLimit": {"placeholders": {"n": {"type": "int"}}},
+  "authPolicyJwtKeySource": "Key source",
+  "authPolicyJwtAudience": "Audience (aud)",
+  "authPolicyJwtIssuer": "Issuer (iss)",
+  "authPolicyJwtScopeClaim": "Scope claim",
+  "authPolicyNotChecked": "not checked",
   "hubAuthTokenHeader": "HUB AUTHENTICATION",
   "hubAuthTokenBlurb": "Bearer token used to authenticate Studio against a hub that has auth.tokens: configured (RBAC Level 2). Stored at ~/.chain/hub-auth-token, mode 0600. Studio sends it as Authorization: Bearer on every gRPC call.",
   "hubAuthTokenStatusConfigured": "Configured ({chars} chars)",
@@ -1578,16 +1601,16 @@
     }
   },
   "addSourceTitle": "Add module source",
-  "addSourceIntro": "`{capability}` is not in the public store. Point the hub at a `.fai` bundle URL or a local bundle path; the hub downloads, verifies (sha256 + signature) and installs it.",
+  "addSourceIntro": "`{capability}` is not in the public store. Point the hub at a `.chain` bundle URL or a local bundle path; the hub downloads, verifies (sha256 + signature) and installs it.",
   "@addSourceIntro": {
     "placeholders": {
       "capability": {"type": "String"}
     }
   },
-  "addSourceField": "URL or path to .fai bundle",
-  "addSourceHint": "https://git.flemming.ai/your-org/your-module/releases/download/v0.1.0/foo-0.1.0.fai",
+  "addSourceField": "URL or path to .chain bundle",
+  "addSourceHint": "https://git.flemming.ai/your-org/your-module/releases/download/v0.1.0/foo-0.1.0.chain",
   "addSourceHowItWorksTitle": "How private modules work",
-  "addSourceHowItWorksBody": "A module is a directory with a module.yaml + the WASM artifact. To share it: pack it (`chain pack <dir>`) and host the resulting `.fai` bundle anywhere (your own Forgejo / GitHub / S3). The hub installs by URL and verifies the signature against its trust store.\n\nDeveloping locally? Use the CLI — Studio cannot install from an unpacked directory (yet):",
+  "addSourceHowItWorksBody": "A module is a directory with a module.yaml + the WASM artifact. To share it: pack it (`chain pack <dir>`) and host the resulting `.chain` bundle anywhere (your own Forgejo / GitHub / S3). The hub installs by URL and verifies the signature against its trust store.\n\nDeveloping locally? Use the CLI — Studio cannot install from an unpacked directory (yet):",
   "addSourceCliExample": "chain install --link /path/to/module",
   "addSourceInstallButton": "Install",
   "addSourceCancel": "Cancel",