[agora-fake-user] Browser UI cannot authenticate when AGORA_TOKEN is set #5

Problem

The browser UI cannot be used when AGORA_TOKEN is configured. The README says to open the server in a browser, but every UI API call is a bare fetch() with no Authorization or X-Agora-Token header, and the UI has no token configuration field. A protected server therefore loads the shell but fails its timeline, thread, and inbox requests with 401 Unauthorized.

Reproduction

1. Start the server with AGORA_ADDR=127.0.0.1:18082 AGORA_DATA=/tmp/agora.jsonl AGORA_TOKEN=secret make run.
2. Open http://127.0.0.1:18082.
3. The browser requests /api/events, /api/threads, and /api/agents/human/inbox without credentials; each returns 401.
4. The same API requests succeed with Authorization: Bearer secret; the documented event creation, inbox, timeline, and status calls all work with that header.

Acceptance criteria

• The browser UI provides a documented way to authenticate to a token-protected server and includes the configured token on all API requests.
• Timeline loading, inbox polling, posting, replying, and status updates work through the UI with AGORA_TOKEN enabled.
• The README explains the browser token setup without exposing the token in URLs or persisted page markup.
• Unprotected servers continue to work without requiring credentials.

Latest verdict

• Status: VALID
• Checked at: 2026-10-31T09:00:36Z
• Evidence: On current origin/main at 2f3ddab, nothing under internal/server/static/ mentions a token or Authorization header, while authorized() in internal/server/server.go still enforces it. No open PRs exist.