feat: v2.7.6 — edit users in one form, Settings → Account, display names, copy over plain HTTP

- Users page: one Edit user form (display name, email, role, active, a new or
  generated password, workspaces given or taken back, sign out everywhere),
  validated as a whole before anything is written (PATCH /api/users/:id,
  GET /api/users/:id); users.display_name/email added migration-safe.
- Settings → Account for every signed-in user: profile, own password (the
  current one required, this login kept), sign out other devices
  (/api/me/account, /api/me/password, /api/me/sign-out-others; login cookie
  only, never a pane token).
- Display names wherever a person is named (sidebar, workspace owner groups,
  Users page and audit log); owner_display_name / reader_display additive.
- Users page: admins add and remove Claude/Codex pool accounts.
- Folder browser: an admin with their own Linux account opens in their home;
  the "Server folder" tick opens the host's (never remembered).
- AI Proxy: "Config 9router" beside Add profile when 9router is installed,
  opened on the dashboard's own host (GET /api/ai-proxies/9router).
- Terminal: a tmux selection reaches the clipboard over plain HTTP too
  (writeClipboard's textarea fallback, focus handed back).
- Chat: a file the session touched outside the workspace previews
  (GET /api/sessions/:id/file).
- install-system: `!requiretty` only when visudo accepts it (sudo-rs on
  Ubuntu 25.10+ rejects the setting).
- openapi.yaml regenerated; docs (API, SERVER-MODE, LANES) updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/lib/pty-run.js

@@ -463,8 +463,12 @@ function spawnRun(args) {
   // A Claude session on the vendor's own API runs on the least-loaded pool
   // account, if the admin added any (claude-pool.js); an AI Proxy brings its
   // own key, and an empty pool leaves the machine's login in charge.
+  // A real login (kind `login`) is written into a MEMBER's home by place();
+  // a setup-token goes in as CLAUDE_CODE_OAUTH_TOKEN.
   const poolAccount =
-    entry.launcher === "claude" && !proxyProfile ? require("./claude-pool").pickAccount() : null;
+    entry.launcher === "claude" && !proxyProfile
+      ? require("./claude-pool").forSpawn(require("./run-as").accountForLane(laneId))
+      : null;
   // Codex likewise, from its own pool (codex-pool.js): an API key through
   // `-e`, or a ChatGPT login written into the member's CODEX_HOME by place().
   const codexPool =
@@ -629,7 +633,7 @@ function spawnRun(args) {
     ...proxySpawn.env,
     // The pool account's setup-token: outranks the machine's `/login` for
     // this process only. Through tmux `-e`, never typed into the pane.
-    ...(poolAccount ? { CLAUDE_CODE_OAUTH_TOKEN: poolAccount.token } : {}),
+    ...(poolAccount ? poolAccount.env : {}),
     ...(codexPool ? codexPool.env : {}),
     // Server mode: the CLI, MCP server and statusline in this pane act as the
     // workspace's owner with it (server/lib/auth.js userFromPaneToken).
@@ -659,8 +663,19 @@ function spawnRun(args) {
     if (timer.unref) timer.unref();
   };
 
-  if (!tmux.hasSession(id)) {
+  // What a pane needs in its account's home before it starts: a Codex pool
+  // login, and — for a member's Claude on a pool account or an AI Proxy — the
+  // onboarding flag, or a fresh home asks for a login the token makes moot.
+  const prepareHome = () => {
     codexPool?.place();
+    poolAccount?.place();
+    if (member && entry.launcher === "claude" && (poolAccount || proxyProfile)) {
+      require("./run-as").markClaudeOnboarded(member);
+    }
+  };
+
+  if (!tmux.hasSession(id)) {
+    prepareHome();
     tmux.newSession({ name: id, cwd, argv: paneArgv(paneCmd, cwd), env });
     record();
     schedulePaste();
@@ -671,7 +686,7 @@ function spawnRun(args) {
     // `--resume` and an initial prompt would never be typed, while the API
     // still answered 200. Run the argv in the pane the user already sees
     // instead of erroring or opening a second session.
-    codexPool?.place();
+    prepareHome();
     tmux.sendCommand(id, paneArgv(paneCmd, cwd), env, cwd);
     record();
     schedulePaste();