feat(settings): add AI Router profiles and attach one per lane

A new **AI Router** tab in Settings, next to Codex, stores named router
endpoints (9Router, OpenRouter, a self-hosted gateway) as profiles: a base
URL, an API key, a default model and an optional per-tier override. The tab
only stores them; a lane CHOOSES one in the Add-lane modal, via a Native /
AI Router radio, and that choice is written into the lane's own config.

The two CLIs are configured differently, and the difference is theirs:

  - a claude lane gets eight `env` keys merged into its own
    `.claude/settings.local.json` (`.local` because the value holds a key);
  - a codex lane gets `$CODEX_HOME/<name>.config.toml` — the layer
    `codex -p <name>` loads — because Codex has NO project-level config.
    Its base `config.toml` is never touched.

Native is a built-in profile rather than a code branch, so "go back to
native" is the same write path. It blanks the two connection variables
instead of removing them (an absent key at project scope lets a USER-level
router apply) and removes the model names instead of writing them (writing
them would override the user's own global model choice).

Key material never leaves the server: profiles live one file each under
`<CLAUDE_HOME>/agenthub-routers/` (0700/0600), `GET /api/ai-routers`
reports only `hasKey`, and there is deliberately no route returning one
profile in full.

Three things this had to get right, each found by review and verified
against the real tools rather than assumed:

  - `wire_api = "chat"` is rejected outright by codex-cli 0.149 ("no longer
    supported"), so every codex lane on a router would have failed to start.
    The layer writes "responses", and writes `env_key` only when the profile
    actually has a key — naming an unset variable is itself a startup error.
  - The key must never be TYPED into a pane. `tmux.sendCommand` used
    `send-keys` with a `KEY='…' cmd` prefix, which the dashboard streams to
    every attached browser and bash appends to history; it now takes over the
    idle pane with `respawn-pane -k -e`, passing env through argv the way
    `newSession` always has. Verified on tmux 3.4: multi-element argv arrives
    intact and the pane renders no trace of the value.
  - Attaching COPIES a profile, so editing or deleting one in Settings has to
    reach the lanes already using it. An edit re-applies it (a rotated key
    would otherwise never reach the lane still holding the revoked one); a
    delete resets those lanes to native and removes the Codex layer file.
    Both report per-lane failures, which the tab surfaces.

`.claude/settings.local.json` is added to the lane's git exclude, for both
native and router lanes: `agenthub lanes reset` runs `git clean -fd` without
`-x`, so an un-excluded settings file is deleted on reset — and untracked
meant the key was committable.

DB: `lanes.router_profile`, nullable, additive. Written only by
`setRouterProfile` beside the disk write, never through `PATCHABLE`.

server/lib/tmux.js

@@ -6,10 +6,11 @@
  * `tmux attach -t agenthub-lane-<id>` (or `agenthub lanes shell`). Never builds a
  * shell string — every call is `execFileSync("tmux", [...argv])` with an
  * explicit argument array (matches this repo's rule for git in worktree.js).
- * The one place a command line is composed is `sendCommand`, which types into
- * an existing pane's shell: there the shell IS the consumer, so every argument
- * is POSIX single-quoted first and sent with `send-keys -l` (literal).
- * `sendText` is the same primitive for the opposite case — a pane running an
+ * No call composes a shell command line at all, `sendCommand` included: it
+ * takes over an idle pane with `respawn-pane -- <argv>` rather than typing a
+ * quoted line into that pane's shell, which keeps an API key passed in `env`
+ * out of the pane's rendered text, its scrollback and the user's shell history.
+ * `sendText` is the one primitive that does send keystrokes — a pane running an
  * interactive chat program that reads stdin as a message, not a shell.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
@@ -88,27 +89,30 @@ function paneCommand(name) {
   }
 }
 
-/** POSIX single-quote escaping — the pane is a shell, so argv must be quoted. */
-function shellQuote(arg) {
-  return `'${String(arg).replace(/'/g, `'\\''`)}'`;
-}
-
 /**
- * Type `argv` into an existing session's pane and press Enter. Only ever
- * called when the pane sits at a shell prompt (see `paneCommand`); `-l` sends
- * the string literally so no character is read as a tmux key name.
+ * Run `argv` in an existing session's pane. Only ever called when the pane sits
+ * at a shell prompt (see `paneCommand`), so what `-k` kills is an idle shell.
  *
- * `env` rides along as a shell assignment prefix on the SAME line — tmux's own
- * `-e` applies only at session creation, and a shell that is already running
- * takes its environment from the command line. The name is never quoted (bash
- * only recognizes an assignment when the `=` is unquoted); the value is.
+ * `respawn-pane` and not `send-keys`, because `env` may carry a secret — an AI
+ * Router's API key, which Codex reads from the variable its `env_key` names.
+ * Typing it would put a `KEY='sk-live-…' codex …` line into the pane's rendered
+ * text, which the dashboard streams to every attached browser, into the tmux
+ * scrollback, and into the user's shell history. `-e` hands the value to the
+ * tmux server through argv instead, exactly as `newSession` already does, and
+ * the pane never renders it. Running argv directly also means no shell to quote
+ * for, so the whole class of quoting bugs goes with it.
  */
-function sendCommand(name, argv, env) {
-  const prefix = Object.entries(env || {})
-    .map(([key, value]) => `${key}=${shellQuote(value)} `)
-    .join("");
-  execImpl(["send-keys", "-t", name, "-l", prefix + argv.map(shellQuote).join(" ")]);
-  execImpl(["send-keys", "-t", name, "Enter"]);
+function sendCommand(name, argv, env, cwd) {
+  execImpl([
+    "respawn-pane",
+    "-k",
+    "-t",
+    name,
+    ...(cwd ? ["-c", cwd] : []),
+    ...envFlags(env),
+    "--",
+    ...argv,
+  ]);
 }
 
 /**