feat: v2.7.6 — edit users in one form, Settings → Account, display names, copy over plain HTTP

- Users page: one Edit user form (display name, email, role, active, a new or
  generated password, workspaces given or taken back, sign out everywhere),
  validated as a whole before anything is written (PATCH /api/users/:id,
  GET /api/users/:id); users.display_name/email added migration-safe.
- Settings → Account for every signed-in user: profile, own password (the
  current one required, this login kept), sign out other devices
  (/api/me/account, /api/me/password, /api/me/sign-out-others; login cookie
  only, never a pane token).
- Display names wherever a person is named (sidebar, workspace owner groups,
  Users page and audit log); owner_display_name / reader_display additive.
- Users page: admins add and remove Claude/Codex pool accounts.
- Folder browser: an admin with their own Linux account opens in their home;
  the "Server folder" tick opens the host's (never remembered).
- AI Proxy: "Config 9router" beside Add profile when 9router is installed,
  opened on the dashboard's own host (GET /api/ai-proxies/9router).
- Terminal: a tmux selection reaches the clipboard over plain HTTP too
  (writeClipboard's textarea fallback, focus handed back).
- Chat: a file the session touched outside the workspace previews
  (GET /api/sessions/:id/file).
- install-system: `!requiretty` only when visudo accepts it (sudo-rs on
  Ubuntu 25.10+ rejects the setting).
- openapi.yaml regenerated; docs (API, SERVER-MODE, LANES) updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/__tests__/api.test.js

@@ -3121,6 +3121,48 @@ describe("GET /api/sessions/:id/outline", () => {
   });
 });
 
+describe("GET /api/sessions/:id/file", () => {
+  it("serves only a text file the session itself read or wrote", async () => {
+    const sid = "read-file-" + Date.now();
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "ah-read-file-"));
+    const report = path.join(dir, "REPORT.md");
+    const other = path.join(dir, "other.md");
+    const bin = path.join(dir, "blob.dat");
+    const cred = path.join(dir, ".credentials.json");
+    const link = path.join(dir, "notes.md");
+    fs.writeFileSync(report, "# Report");
+    fs.writeFileSync(other, "other");
+    fs.writeFileSync(bin, Buffer.from([1, 0, 2]));
+    fs.writeFileSync(cred, "{}");
+    fs.symlinkSync(cred, link);
+    const tool = (tool_name, file_path) =>
+      post("/api/hooks/event", {
+        hook_type: "PostToolUse",
+        data: { session_id: sid, tool_name, tool_input: { file_path }, tool_response: {} },
+      });
+    await post("/api/hooks/event", { hook_type: "SessionStart", data: { session_id: sid } });
+    await tool("Write", report);
+    await tool("Read", bin);
+    await tool("Read", cred);
+    await tool("Edit", link);
+    const url = (p) => `/api/sessions/${sid}/file?path=${encodeURIComponent(p)}`;
+
+    const ok = await fetch(url(report));
+    assert.equal(ok.status, 200);
+    assert.deepEqual(ok.body, { text: "# Report", truncated: false });
+
+    // Never touched, binary, a credential (by name or through a link), relative, no session.
+    assert.equal((await fetch(url(other))).status, 404);
+    assert.equal((await fetch(url(bin))).status, 415);
+    assert.equal((await fetch(url(cred))).status, 403);
+    assert.equal((await fetch(url(link))).status, 403);
+    assert.equal((await fetch(url("REPORT.md"))).status, 400);
+    assert.equal((await fetch(`/api/sessions/nope-file/file?path=${report}`)).status, 404);
+    fs.rmSync(dir, { recursive: true, force: true });
+    assert.equal((await fetch(url(report))).status, 404);
+  });
+});
+
 describe("GET /api/sessions/:id/image", () => {
   it("serves only an image the session itself read", async () => {
     const sid = "read-image-" + Date.now();