feat: v2.7.6 — edit users in one form, Settings → Account, display names, copy over plain HTTP

- Users page: one Edit user form (display name, email, role, active, a new or
  generated password, workspaces given or taken back, sign out everywhere),
  validated as a whole before anything is written (PATCH /api/users/:id,
  GET /api/users/:id); users.display_name/email added migration-safe.
- Settings → Account for every signed-in user: profile, own password (the
  current one required, this login kept), sign out other devices
  (/api/me/account, /api/me/password, /api/me/sign-out-others; login cookie
  only, never a pane token).
- Display names wherever a person is named (sidebar, workspace owner groups,
  Users page and audit log); owner_display_name / reader_display additive.
- Users page: admins add and remove Claude/Codex pool accounts.
- Folder browser: an admin with their own Linux account opens in their home;
  the "Server folder" tick opens the host's (never remembered).
- AI Proxy: "Config 9router" beside Add profile when 9router is installed,
  opened on the dashboard's own host (GET /api/ai-proxies/9router).
- Terminal: a tmux selection reaches the clipboard over plain HTTP too
  (writeClipboard's textarea fallback, focus handed back).
- Chat: a file the session touched outside the workspace previews
  (GET /api/sessions/:id/file).
- install-system: `!requiretty` only when visudo accepts it (sudo-rs on
  Ubuntu 25.10+ rejects the setting).
- openapi.yaml regenerated; docs (API, SERVER-MODE, LANES) updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/__tests__/ai-proxies-9router.test.js

@@ -0,0 +1,57 @@
+/**
+ * @file ai-proxies-9router.test.js
+ * @description `GET /api/ai-proxies/9router` — reports whether a `9router`
+ * binary is on the server's PATH (the AI Proxy page shows its Config 9router
+ * link only then), and never runs it.
+ * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
+ */
+
+const { describe, it, before, after } = require("node:test");
+const assert = require("node:assert/strict");
+const path = require("node:path");
+const fs = require("node:fs");
+const os = require("node:os");
+
+const TMP = fs.mkdtempSync(path.join(os.tmpdir(), "ai-proxies-9router-"));
+process.env.CLAUDE_HOME = path.join(TMP, ".claude");
+
+const express = require("express");
+const router = require("../routes/ai-proxies");
+
+let server;
+let BASE;
+const ORIGINAL_PATH = process.env.PATH;
+const BIN = path.join(TMP, "bin");
+
+before(async () => {
+  fs.mkdirSync(BIN, { recursive: true });
+  const app = express();
+  app.use("/api/ai-proxies", router);
+  await new Promise((resolve) => {
+    server = app.listen(0, "127.0.0.1", resolve);
+  });
+  BASE = `http://127.0.0.1:${server.address().port}`;
+});
+
+after(() => {
+  process.env.PATH = ORIGINAL_PATH;
+  server?.close();
+  fs.rmSync(TMP, { recursive: true, force: true });
+});
+
+const installed = async () =>
+  (await (await fetch(`${BASE}/api/ai-proxies/9router`)).json()).installed;
+
+describe("GET /api/ai-proxies/9router", () => {
+  it("is false when no 9router binary is on PATH", async () => {
+    process.env.PATH = path.join(TMP, "empty");
+    assert.equal(await installed(), false);
+  });
+
+  it("is true once an executable 9router is on PATH", async () => {
+    const bin = path.join(BIN, "9router");
+    fs.writeFileSync(bin, "#!/bin/sh\nexit 1\n", { mode: 0o755 });
+    process.env.PATH = BIN;
+    assert.equal(await installed(), true);
+  });
+});