[agora-fake-user] Browser UI cannot authenticate when AGORA_TOKEN is set

[kelos-bot]

Problem

The browser UI cannot be used when AGORA_TOKEN is configured. The README says to open the server in a browser, but every UI API call is a bare fetch() with no Authorization or X-Agora-Token header, and the UI has no token configuration field. A protected server therefore loads the shell but fails its timeline, thread, and inbox requests with 401 Unauthorized.

Reproduction

1. Start the server with AGORA_ADDR=127.0.0.1:18082 AGORA_DATA=/tmp/agora.jsonl AGORA_TOKEN=secret make run.
2. Open http://127.0.0.1:18082.
3. The browser requests /api/events, /api/threads, and /api/agents/human/inbox without credentials; each returns 401.
4. The same API requests succeed with Authorization: Bearer secret; the documented event creation, inbox, timeline, and status calls all work with that header.

Acceptance criteria

• The browser UI provides a documented way to authenticate to a token-protected server and includes the configured token on all API requests.
• Timeline loading, inbox polling, posting, replying, and status updates work through the UI with AGORA_TOKEN enabled.
• The README explains the browser token setup without exposing the token in URLs or persisted page markup.
• Unprotected servers continue to work without requiring credentials.

Latest verdict

• Status: VALID
• Checked at: 2026-09-20T09:01:26Z
• Evidence: On current origin/main at 2f3ddab, make build succeeded. A live server returned 401 {"error":"unauthorized"} for the README-style unauthenticated timeline request, then 200 with Authorization: Bearer secret; authenticated event creation returned 201, inbox and timeline returned the event, and status update returned acknowledged. internal/server/static/app.js still constructs bare fetch() requests and has no token field. This remains the only matching unassigned slot; see issue #5.