webclient: hold the chat at the bottom when a stream ends ...

The list was pinned per streaming delta, but the last things to land arrive
after that final pin: the stats/rating footer, which renders only once
msg.done is set, and the copy buttons attached to code blocks after render.
Nothing re-clamped afterwards — the length watcher never fires (the message
stays in the array) and the landing loop only runs when a session opens — so
the view was left short of the bottom, looking like it had scrolled up.

Re-clamp through the same settle window the landing uses when streaming goes
true -> false, unless the user has scrolled up or a session is loading.
This addresses the late-layout half of the problem; the row is still remounted
when msg.id becomes h_<n>, which is the other source of a jump.

webclient: reload tools from a button in the MCP tab ...

Settings → MCP gains a Tools block for admins only: one button, then the
same report the tool prints — what loaded, how many are in the registry,
per-file errors, and names in enabled.json nothing answers to.

It sits inside the existing MCP tab rather than a new one: the reload
rewrites the toolset of the whole server, not just this user's MCP keys,
and it belongs next to the thing it affects. Non-admins never see it.

dist rebuilt together with the source, as the server serves the bundle.

webclient: serve the PWA artwork past the images cache ...

/images/* is served cache-first from IMAGES_CACHE, which activate deliberately
keeps across builds. That is right for content whose URL is unique and wrong
for the app's own artwork: /images/icon-*, /images/logo-icon* and
/images/apple-splash/* keep their URLs while their contents change with the
logo, so a browser that had once loaded an icon would keep showing the old one
even after a deploy — and the apple-touch-icon is linked from index.html, so it
does travel through the page and the service worker.

Those paths now go network-first with a cached fallback (offline still works);
every other /images/ request is untouched.

Tests: frontend 148 passed; backend 1367 passed, 1 skipped.

MCP settings tab: list every connected server, slot only where declared ...

The tab was empty on every install: it listed only servers whose config
declares a `user_key` slot, and no config declared one — which read as
"no MCP servers connected" even though five are wired to profiles.

- GET /mcp-keys now returns every server referenced by at least one
  profile, keyed ones first, with `accepts_user_key`, the slot location
  (null when there is none) and the profile ids that connect it. The
  per-user key store is skipped entirely when nothing has a slot.
- gnexus-creds declares `user_key: {header: Authorization, prefix:
  "Bearer "}` — it is the one server carrying a shared credential, so its
  personal-key field is now real: users with a key run under their own,
  users without one fall back to the shared default.
- The panel lists all servers (transport + profiles), dims the keyless
  rows, and shows a key input only for slotted ones, spelling out the
  shared-key fallback.

docs/api.md and docs/mcp.md updated; backend 1367 passed, webclient 148.

Android app: native push notifications via JS bridge + background hold ...

WebView has no Push API, so the app shows notifications natively:

- NaviBridge JS interface (window.NaviAndroid): notify(), permission
  request with a 'navi-perm-result' event callback, background-mode
  start/stop and the Doze-exemption ask.
- BackgroundService: dataSync foreground service + partial wake lock —
  holds the process (and the WebView WebSocket) open while the app is
  minimized; quiet persistent notification with a "Отключить фон" action.
  Notification channels: silent background presence, high-importance
  messages.
- Manifest: POST_NOTIFICATIONS / FOREGROUND_SERVICE(_DATA_SYNC) /
  WAKE_LOCK / REQUEST_IGNORE_BATTERY_OPTIMIZATIONS + service entry;
  notification tap resumes MainActivity (singleTask) into open_url.
- webclient: nativeBridge composable; usePush gets a bridge mode that
  replaces web-push entirely (settings toggle keeps working); chat store
  raises 'Navi ответила' through the bridge on stream end when the
  window is hidden. Fixed a latent undefined-variable in web syncState
  (notificationsSupported -> notifSupported()).
- New unit tests for the bridge surface; 147 frontend tests + APK build
  pass.

webclient: settings tab polish, light chat-table styling, iOS launch screens ...

- Synapse tab icon was a no-op glyph: ph-diagram-project does not exist in
  the bundled Phosphor regular set — the button rendered bare text. Switched
  to ph-network, which ships.
- .settings-tabs capped at 1200px width on wide screens (was max-width:none).
- Chat markdown tables: the old .msg-assistant-content .table rules were
  dead (markdown never adds a .table class) — retarget .table-wrap table and
  restyle lightly: framed border + radius, muted header row, plain row
  separators, no uppercase/no hover color jump.
- iOS home-screen: apple-mobile-web-app metas and a full apple-touch-startup-
  image set (24 device classes, portrait+landscape) rendered from logo.svg
  on the theme background.

webclient: PWA hardening — stable height skeleton, touch selection policy, fixed maskable icons ...

- html/body/#app height via percentages instead of 100vh/dvh: the standalone
  PWA visual viewport drifts with keyboard/system panels, which let the
  document exceed the screen and scroll fixed headers away.
- viewport meta gains interactive-widget=resizes-content; phone-width inputs
  (textarea/text) are pinned to 16px to avoid mobile focus zoom.
- Selection policy: service chrome (chat header, sidebar, tab strip, input
  bar, meta rows) is unselectable with -webkit-touch-callout, killing the
  'Search with Google' sheet on long-press; message content and settings
  panels keep selectable text.
- Apple touch icon switched to a proper 180px tile.
- Regenerated maskable icons (were degenerate 1px-tall files): dark
  background plus the logo inside the 80% safe zone.
- manifest gains display_override.

webclient: fix mobile tab-block drift — column flex nowrap + stretch, kit table scrolls inside its wrapper

webclient: reveal the active settings tab when the mobile tab strip scrolls

webclient: settings header now literally the chat header; app-wide thin rounded scrollbars (override kit's thick square defaults)

webclient: exclusive radio groups in Synapse reactions (distinct names, kit options API); mobile sidebar row swaps close button after New Chat

webclient: settings page fits the app frame — flat chat-style header bar, single full-bleed scroll region, mobile adaptation (stacked MCP rows, viewport-safe modals)

webclient: MCP keys tab gets an empty-state when no server declares a user_key slot

webclient: settings page split into GnTabs sections (Account/Notifications/Synapse/MCP)

webclient: settings loaders switched to kit circle spinner (GnLoader circle)

webclient: MCP user keys panel (BYOK) + frontend tests

webclient: top margin on settings header

webclient: Synapse reactions settings + service sessions toggle ...

- sidebar: service-sessions toggle (special=true fetch replaces the
  regular list, active search drops out), muted style + robot icon on
  special items in the list
- settings: Synapse reactions panel — enable switch, completion push
  preference (always / only failures / never), notification destination
  (app / app+Synapse / Synapse, Synapse options disabled while no
  source key), reaction instructions editor with save + edit history
  (author and reason per version)
- stores: synapseReactions store; sessions store fetches respect
  showSpecial; getSessions passes special param
- vitest for api/session store/panel; dist rebuilt

webclient: remove session list dividers, 42px sidebar logo, truncate long file names in preview pill

handbook alignment: profile.updated mirror, health contract, Synapse gateway ...

Handbook gaps closed (10-platform auth/health/notifications):

- webhooks: handle user.profile_updated — mirror the gnexus-auth profile
  into navi_users (name, contact fields, avatar_url — new column, boot
  migration); role/permissions keep their dedicated events
- auth: avatar_url now flows through the login upsert and the API-token
  resolution path
- /health: status is now the aggregate of the sub-checks (degraded embed
  or hive no longer reports plain ok); embed probe cached for 10 s; body
  grew the machine-readable checks{} map, legacy embed/hive payloads kept
- Synapse: s2s delivery gateway — POST /webhooks/synapse (both spellings),
  per-user delivery secrets (synapse_targets, Fernet-encrypted, shown
  once), verification via gnexus-synapse v0.1.2 client lib, idempotent
  event ids; deliveries are verified and logged for now — navi generates
  no outbound events by decision; web-push stays as the local browser
  channel
- webclient settings: Synapse deliveries panel (add/revoke targets)

webclient: revert LoginScreen to the custom card ...

The kit login-card markup read heavier (uppercase header, wide chrome
border) than the original centered card — restoring the previous
version per user preference.

webclient: LoginScreen rebuilt on kit markup ...

The SSO-only login doesn't fit GnLoginCard's username/password form (the
adapter always renders both fields), so the escape-hatch card is replaced
with the kit's own login-card markup (article.card.login-card + header +
card-content + GnButton) — the same contract kit.css ships for
GnLoginCard, minus the form. Custom card border/title/subtitle styles are
gone; overlay keeps positioning only.

webclient: apply kit radii to content-cards and viewed-image thumbs, fix dead scss tokens ...

The content-card and ArtifactsPanel style blocks used @use 'kit-deps'
inside <style scoped> without lang=scss, so sass never ran: the
-radius-md token stayed a literal in the built CSS and the
browser saw border-radius: -radius-md (invalid → 0 corners).
Both blocks now declare lang=scss and compile to the kit's 6px radius.

Also rounds the corners of user-message image attachments and adds the
missing label prop on the tools-collapse icon button (kit dev warning).

webclient: cap thinking body at 800px, smooth details close, Navi-viewed images grouped in artifacts ...

- thinking-body: max-height 800px + inner scroll so long reasoning
  doesn't grow the whole chat
- content-card: body stays mounted after first open (no v-show teardown
  at toggle time) — ::details-content now has real content to shrink,
  so collapsing animates smoothly instead of snapping to 0 in a frame
- synthetic '[Image loaded via ...]' messages from vision tools are no
  longer rendered as user bubbles; their images are collected (live from
  tool_call metadata, and from history) into a viewed-images group at
  the top of the artifacts tab, thumbnails open the lightbox

webclient: tool-count badge, kit-styled content card, thinking corner gap, chat top gap, drop duplicate reconnect notice

webclient + navi: session title click-to-rename; empty rename regenerates via LLM

webclient: profile chips — wheel + swipe scroll, no status markers, clicked chip slides into view

webclient: profile chips in sidebar; New Chat opens welcome; profile tap starts session; welcome grid 4-up

webclient: lightbox closes on browser/back-gesture ...

Opening the lightbox pushes a history entry ({lightbox: true}); popstate
closes the modal instead of walking the session history (mobile back
gesture used to leave the modal open and jump sessions). Cross/backdrop
close pops the pushed entry, so the gesture history has no stale records

webclient: artifacts panel — link hover color, single-row tabs, refresh moved right ...

- .link-item hover/active title: text-light instead of black (unreadsble
  on the row hover tint)
- tab chips never wrap: container queries on the panel squeeze padding/
  font/gap and drop the icons below 360px
- files refresh: default-size GnIconButton aligned to the toolbar right