The review done-card stops assuming why titles are unresolved

Clean-run finding #2 from Eric: with a token loaded and resolve simply
not yet run, the card still said unmatched titles were "waiting on the
API token" — stub-era copy hard-coding the only reason unresolved
titles existed back then. The summary payload now carries
token_present (a boolean, never the value — pinned by test), and the
card gives the advice that fits: token loaded → "run resolve";
no token → the waiting message, now with a link to BGG's application
page since that reader hasn't registered yet.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016jXZFSTZQKzAC8fqpWSz9g

tests/test_webreview.py

@@ -1429,3 +1429,17 @@ def test_readding_a_removed_hand_added_title_rescinds_the_removal(tmp_path):
     assert web.post("/api/add-title", json=add).status_code == 200
     titles = json.loads(cfg.titles_path.read_text())
     assert any(t["title_raw"] == "Homebrew Quest" for t in titles)
+
+
+def test_review_summary_reports_token_presence_not_value(tmp_path, monkeypatch):
+    """The done-card's advice differs between "run resolve" and "get a
+    token": the payload carries presence as a boolean, never the value."""
+    monkeypatch.setenv("BGG_API_TOKEN", "secret-token-value")
+    web, _ = make_client(tmp_path)
+    body = web.get("/api/state")
+    assert body.json()["summary"]["token_present"] is True
+    assert "secret-token-value" not in body.text
+
+    monkeypatch.delenv("BGG_API_TOKEN")
+    web2, _ = make_client(tmp_path / "tokenless")
+    assert web2.get("/api/state").json()["summary"]["token_present"] is False