feat(settings): hub auth-policy panel — T4/T5 security parity in the GUI

Settings → Security now shows the hub's effective auth policy via the
new read-only AuthStatus RPC: active token validator (static / jwt-rs256
with issuer, audience, JWKS source), anonymous-access warning, per-token
cards with scope grants, env-var presence and rate limits, plus a
localized admin-denied story for non-admin tokens. Live-reloads on
endpoint change.

Also fixes a batch of fai→chain rename leftovers this panel's
verification uncovered: hub_auth_token.dart and registry_token.dart
read/wrote ~/.fai/ while the hub reads ~/.chain/ (stored registry
tokens never reached the hub), today_story_loader + tools/today used
~/.fai/today, chain_log legacy ~/.fai/logs migration removed per the
no-legacy-recognisers decision, and UI strings still advertised the
retired .fai bundle extension.

Includes 5 widget tests for the panel, an integration-test screenshot
harness (auth_policy_shots_test.dart, guide-shots style), and DE+EN
l10n. flutter analyze clean, 58 tests green.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

tools/today/README.md

@@ -9,12 +9,12 @@ See `../../docs/today-pipeline.md` for the full design rationale.
 # 1. Generate today's proposals (calls the local Ollama by default).
 ./propose.sh
 
-# 2. Skim them — they sit under ~/.fai/today/proposals/<ISO-DATE>/
-ls ~/.fai/today/proposals/
+# 2. Skim them — they sit under ~/.chain/today/proposals/<ISO-DATE>/
+ls ~/.chain/today/proposals/
 
-# 3. Accept one. The chosen file becomes ~/.fai/today/active.yaml,
+# 3. Accept one. The chosen file becomes ~/.chain/today/active.yaml,
 #    which Studio reads at startup.
-./accept.sh ~/.fai/today/proposals/2026-05-08/candidate-2.yaml
+./accept.sh ~/.chain/today/proposals/2026-05-08/candidate-2.yaml
 
 # 4. Restart Studio (or let the next launch pick it up).
 ```
@@ -65,8 +65,8 @@ or `generate`; the script auto-detects from the URL path.
   installed Ch∆In monorepos. Never your audit log without explicit op-in.
 - Calls only the System-AI you've already configured for Studio. The same
   privacy mode you set there applies here.
-- Writes only into `~/.fai/today/`. Nothing in `~/.fai/data/` or
-  `~/.fai/config.yaml` is touched.
+- Writes only into `~/.chain/today/`. Nothing in `~/.chain/data/` or
+  `~/.chain/config.yaml` is touched.
 - Studio loads `active.yaml` at startup; if the file is missing or fails
   schema validation, the compiled-in fallback story renders. KRITIS
   fresh installs see the fallback until and unless an operator accepts a