csrf: the shared same-origin guard

Five services carried their own copy of the Origin/Referer check and the
copies had drifted, not only in wording: tokens, cover and bench apply it
as router-wide middleware, while dolt and specs call a predicate from
individual handlers, so a form added to either of those goes out
unguarded. Require is therefore the API this package leads with, and
SameOrigin is the escape hatch for a service migrating one route at a
time.

assets: the shared hashed-asset discovery and cache policy

gitignore the in-repo git worktree directories

chrome: give the brand both halves, and share the login URL and time helpers

The brand was upstream's minus its hub link: core.sr.ht points the whole
brand at hub when the instance has one and drops the red service label,
while this package kept the label and pointed at the service root. Hub is
excluded from the switcher, so that left the chrome with no route to hub at
all. Split the brand in two — the site name to hub (to the service root on
an instance without one), the label to the service root — and neither half
has to lose. The label keeps its own <span class="text-danger"> because the
theme colours ".navbar-light .navbar-brand a", which outranks .text-danger
and would repaint a red <a> white in dark mode.

LoginURLFor exports the line Page already computed. A handler that gates a
page behind login was building an entire Page to read one field off it.

RelTime/AbsTime come up from the services, where the copies had already
drifted over what to print for a future instant: "in 3 hours" on one
service, "just now" on the next, for the same timestamp.

bearer: split the grant check out of validation

A sourcehut service resolves identity once per request in middleware, upstream
of the router — that is where the cookie plane and the bearer plane meet and
where a principal is put on the context — and at that point nothing knows which
route will run, so nothing knows the action. The action is known one layer down,
in the handler.

Validate insisted on both at once, which left every adopting service two bad
options: invent an action before it has one, or lift its bearer plane out of the
middleware every other plane goes through. The second is how a surface ends up
with two different ideas of who is calling.

So Inspect answers steps 1, 2 and 4 — who, what may they do, is it still live —
and Token.Authorize is step 3, asked where the action finally exists. Validate
is unchanged for callers that know both at one point.

It keeps its own ordering rather than becoming Inspect+Authorize: step 3 before
step 4 means a token that does not carry the grant is refused without a round
trip to the daemon, and a test pins that. Inspect cannot keep that ordering,
having no action to refuse on, and that is the one cost of the split — written
down at both call sites.

bearer: the shared working-token validator of SPEC ch. 6

grants: the shared grant vocabulary of tokens.sr.ht

chrome: repo-list partial and fixed-width brand

srht-repo-list renders project listings (repos, databases, spaces) as
the family's event-list cards from a neutral ListItem shape, encoding
the rules the services converged on: h4 title link, visibility as small
muted lowercase text on the right for non-public entries only,
description as a paragraph. The empty state is a parameter.

The brand in srht-nav gains min-width: 15rem so the service switcher
starts at the same x-coordinate on every service — without it the menu
shifts by the width of the red service label when hopping between
services.

ci: gitsync mirror webhook for the srht mirror

chrome: shared page chrome for the instance's custom services

Extract the nav/chrome idiom that compare, spec, dolt and cover each
carried as a private copy (and bench was about to fork as a sixth):
BuildNav over the shared config.ini with the canonical ordering and
paste/pages/hub exclusions, a per-request Page with login/logout/profile
URLs against meta's unified login, embedded srht-nav / srht-env-banner
partials (circle brand + red service label + switcher + login box), and
the generic dict/shortsha template helpers.

Policy decisions the copies had drifted on are baked in: switcher only
for authenticated viewers, hub excluded in the builder rather than the
template, profile link prefers hub's ~username page, environment name
uppercased for the banner. Service-specific needs surfaced by the cover
survey get seams instead of copies: ExtraNav for extra switcher entries,
ContainerClass for full-bleed pages, the config section as an explicit
parameter for the active check.