feat(settings): hub auth-policy panel — T4/T5 security parity in the GUI

Settings → Security now shows the hub's effective auth policy via the
new read-only AuthStatus RPC: active token validator (static / jwt-rs256
with issuer, audience, JWKS source), anonymous-access warning, per-token
cards with scope grants, env-var presence and rate limits, plus a
localized admin-denied story for non-admin tokens. Live-reloads on
endpoint change.

Also fixes a batch of fai→chain rename leftovers this panel's
verification uncovered: hub_auth_token.dart and registry_token.dart
read/wrote ~/.fai/ while the hub reads ~/.chain/ (stored registry
tokens never reached the hub), today_story_loader + tools/today used
~/.fai/today, chain_log legacy ~/.fai/logs migration removed per the
no-legacy-recognisers decision, and UI strings still advertised the
retired .fai bundle extension.

Includes 5 widget tests for the panel, an integration-test screenshot
harness (auth_policy_shots_test.dart, guide-shots style), and DE+EN
l10n. flutter analyze clean, 58 tests green.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/l10n/app_localizations.dart

@@ -2555,7 +2555,7 @@ abstract class AppLocalizations {
   /// No description provided for @registryCredentialsBlurb.
   ///
   /// In en, this message translates to:
-  /// **'Token used to download .fai modules from a registry behind a signin wall (Forgejo, GitHub-private). Stored at ~/.chain/registry-token, mode 0600. The CHAIN_REGISTRY_TOKEN env var still wins when set.'**
+  /// **'Token used to download .chain modules from a registry behind a signin wall (Forgejo, GitHub-private). Stored at ~/.chain/registry-token, mode 0600. The CHAIN_REGISTRY_TOKEN env var still wins when set.'**
   String get registryCredentialsBlurb;
 
   /// No description provided for @registryTokenStatusConfigured.
@@ -2618,6 +2618,120 @@ abstract class AppLocalizations {
   /// **'Could not save: {error}'**
   String registryTokenSaveFailedToast(String error);
 
+  /// No description provided for @authPolicyHeader.
+  ///
+  /// In en, this message translates to:
+  /// **'HUB ACCESS POLICY'**
+  String get authPolicyHeader;
+
+  /// No description provided for @authPolicyBlurb.
+  ///
+  /// In en, this message translates to:
+  /// **'How the hub checks incoming calls: the active validator, the tokens and their scope grants. Secrets stay in environment variables — only their names appear here.'**
+  String get authPolicyBlurb;
+
+  /// No description provided for @authPolicyValidatorStatic.
+  ///
+  /// In en, this message translates to:
+  /// **'Validator: static token list'**
+  String get authPolicyValidatorStatic;
+
+  /// No description provided for @authPolicyValidatorJwt.
+  ///
+  /// In en, this message translates to:
+  /// **'Validator: JWT (RS256) via an external identity provider'**
+  String get authPolicyValidatorJwt;
+
+  /// No description provided for @authPolicyAnonymous.
+  ///
+  /// In en, this message translates to:
+  /// **'No tokens configured — the hub accepts anonymous calls. Fine for local work; configure tokens in ~/.chain/config.yaml for production.'**
+  String get authPolicyAnonymous;
+
+  /// No description provided for @authPolicyNeedsAdmin.
+  ///
+  /// In en, this message translates to:
+  /// **'This view needs a token with the admin scope. Store it above under “Hub authentication” and reload.'**
+  String get authPolicyNeedsAdmin;
+
+  /// No description provided for @authPolicyHubTooOld.
+  ///
+  /// In en, this message translates to:
+  /// **'The connected hub does not know this view yet — it is older than Studio. Update the hub (chain update apply) and reload.'**
+  String get authPolicyHubTooOld;
+
+  /// No description provided for @authPolicyRetry.
+  ///
+  /// In en, this message translates to:
+  /// **'Retry'**
+  String get authPolicyRetry;
+
+  /// No description provided for @authPolicyReload.
+  ///
+  /// In en, this message translates to:
+  /// **'Reload tokens'**
+  String get authPolicyReload;
+
+  /// No description provided for @authPolicyReloadDone.
+  ///
+  /// In en, this message translates to:
+  /// **'Reloaded — {n} tokens active.'**
+  String authPolicyReloadDone(int n);
+
+  /// No description provided for @authPolicyEditHint.
+  ///
+  /// In en, this message translates to:
+  /// **'The policy is edited in ~/.chain/config.yaml (auth: section). After a change or token rotation, reload here — the hub applies it without a restart.'**
+  String get authPolicyEditHint;
+
+  /// No description provided for @authPolicyEnvSet.
+  ///
+  /// In en, this message translates to:
+  /// **'Environment variable {env} is set'**
+  String authPolicyEnvSet(String env);
+
+  /// No description provided for @authPolicyEnvMissing.
+  ///
+  /// In en, this message translates to:
+  /// **'Environment variable {env} is MISSING — the token is unusable'**
+  String authPolicyEnvMissing(String env);
+
+  /// No description provided for @authPolicyRateLimit.
+  ///
+  /// In en, this message translates to:
+  /// **'{n}/min'**
+  String authPolicyRateLimit(int n);
+
+  /// No description provided for @authPolicyJwtKeySource.
+  ///
+  /// In en, this message translates to:
+  /// **'Key source'**
+  String get authPolicyJwtKeySource;
+
+  /// No description provided for @authPolicyJwtAudience.
+  ///
+  /// In en, this message translates to:
+  /// **'Audience (aud)'**
+  String get authPolicyJwtAudience;
+
+  /// No description provided for @authPolicyJwtIssuer.
+  ///
+  /// In en, this message translates to:
+  /// **'Issuer (iss)'**
+  String get authPolicyJwtIssuer;
+
+  /// No description provided for @authPolicyJwtScopeClaim.
+  ///
+  /// In en, this message translates to:
+  /// **'Scope claim'**
+  String get authPolicyJwtScopeClaim;
+
+  /// No description provided for @authPolicyNotChecked.
+  ///
+  /// In en, this message translates to:
+  /// **'not checked'**
+  String get authPolicyNotChecked;
+
   /// No description provided for @hubAuthTokenHeader.
   ///
   /// In en, this message translates to:
@@ -4541,19 +4655,19 @@ abstract class AppLocalizations {
   /// No description provided for @addSourceIntro.
   ///
   /// In en, this message translates to:
-  /// **'`{capability}` is not in the public store. Point the hub at a `.fai` bundle URL or a local bundle path; the hub downloads, verifies (sha256 + signature) and installs it.'**
+  /// **'`{capability}` is not in the public store. Point the hub at a `.chain` bundle URL or a local bundle path; the hub downloads, verifies (sha256 + signature) and installs it.'**
   String addSourceIntro(String capability);
 
   /// No description provided for @addSourceField.
   ///
   /// In en, this message translates to:
-  /// **'URL or path to .fai bundle'**
+  /// **'URL or path to .chain bundle'**
   String get addSourceField;
 
   /// No description provided for @addSourceHint.
   ///
   /// In en, this message translates to:
-  /// **'https://git.flemming.ai/your-org/your-module/releases/download/v0.1.0/foo-0.1.0.fai'**
+  /// **'https://git.flemming.ai/your-org/your-module/releases/download/v0.1.0/foo-0.1.0.chain'**
   String get addSourceHint;
 
   /// No description provided for @addSourceHowItWorksTitle.
@@ -4565,7 +4679,7 @@ abstract class AppLocalizations {
   /// No description provided for @addSourceHowItWorksBody.
   ///
   /// In en, this message translates to:
-  /// **'A module is a directory with a module.yaml + the WASM artifact. To share it: pack it (`chain pack <dir>`) and host the resulting `.fai` bundle anywhere (your own Forgejo / GitHub / S3). The hub installs by URL and verifies the signature against its trust store.\n\nDeveloping locally? Use the CLI — Studio cannot install from an unpacked directory (yet):'**
+  /// **'A module is a directory with a module.yaml + the WASM artifact. To share it: pack it (`chain pack <dir>`) and host the resulting `.chain` bundle anywhere (your own Forgejo / GitHub / S3). The hub installs by URL and verifies the signature against its trust store.\n\nDeveloping locally? Use the CLI — Studio cannot install from an unpacked directory (yet):'**
   String get addSourceHowItWorksBody;
 
   /// No description provided for @addSourceCliExample.