feat: v2.7.6 — edit users in one form, Settings → Account, display names, copy over plain HTTP

- Users page: one Edit user form (display name, email, role, active, a new or
  generated password, workspaces given or taken back, sign out everywhere),
  validated as a whole before anything is written (PATCH /api/users/:id,
  GET /api/users/:id); users.display_name/email added migration-safe.
- Settings → Account for every signed-in user: profile, own password (the
  current one required, this login kept), sign out other devices
  (/api/me/account, /api/me/password, /api/me/sign-out-others; login cookie
  only, never a pane token).
- Display names wherever a person is named (sidebar, workspace owner groups,
  Users page and audit log); owner_display_name / reader_display additive.
- Users page: admins add and remove Claude/Codex pool accounts.
- Folder browser: an admin with their own Linux account opens in their home;
  the "Server folder" tick opens the host's (never remembered).
- AI Proxy: "Config 9router" beside Add profile when 9router is installed,
  opened on the dashboard's own host (GET /api/ai-proxies/9router).
- Terminal: a tmux selection reaches the clipboard over plain HTTP too
  (writeClipboard's textarea fallback, focus handed back).
- Chat: a file the session touched outside the workspace previews
  (GET /api/sessions/:id/file).
- install-system: `!requiretty` only when visudo accepts it (sudo-rs on
  Ubuntu 25.10+ rejects the setting).
- openapi.yaml regenerated; docs (API, SERVER-MODE, LANES) updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/__tests__/server-s3-review2.test.js

@@ -226,6 +226,39 @@ describe("a developer browses and lists branches only in their own folder", () =
     assert.equal(admin.status, 200);
   });
 
+  it("an admin starts in their own home, and opens the host's only with host=1", async () => {
+    // No Linux account: the host's home, and no Server folder tick.
+    const plain = await call("boss", "GET", "/api/lanes/browse");
+    assert.equal(plain.status, 200);
+    assert.equal(plain.body.path, os.homedir());
+    assert.equal(plain.body.hostHome, undefined);
+    // With one (ah-boss, home <USERS>/boss): their own home first.
+    const BOSS = path.join(USERS, "boss");
+    fs.mkdirSync(path.join(BOSS, "work"), { recursive: true });
+    const passwd = fs.readFileSync(process.env.AGENTHUB_PASSWD, "utf8");
+    const uid = process.getuid();
+    fs.writeFileSync(process.env.AGENTHUB_PASSWD, passwd + `ah-boss:x:${uid}:${uid}::/:/bin/sh\n`);
+    runAs.__resetCache();
+    try {
+      const own = await call("boss", "GET", "/api/lanes/browse");
+      assert.equal(own.status, 200, JSON.stringify(own.body));
+      assert.equal(own.body.path, BOSS);
+      assert.equal(own.body.home, BOSS);
+      assert.equal(own.body.hostHome, os.homedir());
+      assert.ok(own.body.parent, "an admin is not held to their home");
+      const host = await call("boss", "GET", "/api/lanes/browse?host=1");
+      assert.equal(host.body.path, os.homedir());
+      assert.equal(host.body.home, os.homedir());
+      // A developer's host=1 changes nothing: still their own folder.
+      const mia = await call("mia", "GET", "/api/lanes/browse?host=1");
+      assert.equal(mia.body.path, MIA);
+      assert.equal(mia.body.hostHome, undefined);
+    } finally {
+      fs.writeFileSync(process.env.AGENTHUB_PASSWD, passwd);
+      runAs.__resetCache();
+    }
+  });
+
   it("hidden=1 shows dot entries, never the logins at the top of their home", async () => {
     fs.mkdirSync(path.join(MIA, ".claude"), { recursive: true });
     fs.mkdirSync(path.join(MIA, "proj", ".cfg"), { recursive: true });