feat: v2.7.6 — edit users in one form, Settings → Account, display names, copy over plain HTTP

- Users page: one Edit user form (display name, email, role, active, a new or
  generated password, workspaces given or taken back, sign out everywhere),
  validated as a whole before anything is written (PATCH /api/users/:id,
  GET /api/users/:id); users.display_name/email added migration-safe.
- Settings → Account for every signed-in user: profile, own password (the
  current one required, this login kept), sign out other devices
  (/api/me/account, /api/me/password, /api/me/sign-out-others; login cookie
  only, never a pane token).
- Display names wherever a person is named (sidebar, workspace owner groups,
  Users page and audit log); owner_display_name / reader_display additive.
- Users page: admins add and remove Claude/Codex pool accounts.
- Folder browser: an admin with their own Linux account opens in their home;
  the "Server folder" tick opens the host's (never remembered).
- AI Proxy: "Config 9router" beside Add profile when 9router is installed,
  opened on the dashboard's own host (GET /api/ai-proxies/9router).
- Terminal: a tmux selection reaches the clipboard over plain HTTP too
  (writeClipboard's textarea fallback, focus handed back).
- Chat: a file the session touched outside the workspace previews
  (GET /api/sessions/:id/file).
- install-system: `!requiretty` only when visudo accepts it (sudo-rs on
  Ubuntu 25.10+ rejects the setting).
- openapi.yaml regenerated; docs (API, SERVER-MODE, LANES) updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/lib/cc-usage.js

@@ -108,25 +108,31 @@ async function refreshProfile(name) {
     throw err("ENOREFRESH", `profile ${name} has no refresh token — re-save it from a login`);
   }
 
+  const fresh = await exchangeRefresh(creds);
+  profiles.writeProfile(name, { ...stored, credentials: fresh });
+  return fresh.accessToken;
+}
+
+/**
+ * One refresh-token exchange: `creds` (a `claudeAiOauth` block) with its new
+ * access token, refresh token and expiry. The CALLER must persist the result —
+ * Anthropic retires the refresh token it was handed (see `refreshProfile`).
+ */
+async function exchangeRefresh(creds) {
   const data = await postJson(TOKEN_URL, {
     grant_type: "refresh_token",
     refresh_token: creds.refreshToken,
     client_id: CLIENT_ID,
   });
   if (!data.access_token) throw err("EUPSTREAM", "the token endpoint returned no access_token");
-
-  profiles.writeProfile(name, {
-    ...stored,
-    credentials: {
-      ...creds,
-      accessToken: data.access_token,
-      // Both are rotated by the exchange; keeping the old refresh token here
-      // would pin the profile to a credential that no longer works.
-      refreshToken: data.refresh_token || creds.refreshToken,
-      expiresAt: Date.now() + (Number(data.expires_in) || 0) * 1000,
-    },
-  });
-  return data.access_token;
+  return {
+    ...creds,
+    accessToken: data.access_token,
+    // Both are rotated by the exchange; keeping the old refresh token here
+    // would pin the profile to a credential that no longer works.
+    refreshToken: data.refresh_token || creds.refreshToken,
+    expiresAt: Date.now() + (Number(data.expires_in) || 0) * 1000,
+  };
 }
 
 /** The two windows the UI reports, flattened out of a response that also
@@ -245,6 +251,7 @@ module.exports = {
   fetchOwner,
   liveOwner,
   refreshProfile,
+  exchangeRefresh,
   CLIENT_ID,
   USAGE_URL,
   TOKEN_URL,