feat: v2.7.6 — edit users in one form, Settings → Account, display names, copy over plain HTTP

- Users page: one Edit user form (display name, email, role, active, a new or
  generated password, workspaces given or taken back, sign out everywhere),
  validated as a whole before anything is written (PATCH /api/users/:id,
  GET /api/users/:id); users.display_name/email added migration-safe.
- Settings → Account for every signed-in user: profile, own password (the
  current one required, this login kept), sign out other devices
  (/api/me/account, /api/me/password, /api/me/sign-out-others; login cookie
  only, never a pane token).
- Display names wherever a person is named (sidebar, workspace owner groups,
  Users page and audit log); owner_display_name / reader_display additive.
- Users page: admins add and remove Claude/Codex pool accounts.
- Folder browser: an admin with their own Linux account opens in their home;
  the "Server folder" tick opens the host's (never remembered).
- AI Proxy: "Config 9router" beside Add profile when 9router is installed,
  opened on the dashboard's own host (GET /api/ai-proxies/9router).
- Terminal: a tmux selection reaches the clipboard over plain HTTP too
  (writeClipboard's textarea fallback, focus handed back).
- Chat: a file the session touched outside the workspace previews
  (GET /api/sessions/:id/file).
- install-system: `!requiretty` only when visudo accepts it (sudo-rs on
  Ubuntu 25.10+ rejects the setting).
- openapi.yaml regenerated; docs (API, SERVER-MODE, LANES) updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/routes/lanes.js

@@ -569,6 +569,10 @@ router.post("/gc", sameOriginGuard, (req, res) => {
  * `hidden=1` lists dot entries too — never those at the top of a non-admin's
  * own folder, where a member's logins live. Each entry carries its `mtime`
  * (ms), and `home` is the folder the browser's Home place opens.
+ * An admin with a Linux account of their own (S3) starts in THEIR home, like
+ * any member, and the answer carries `hostHome` (the host account's home);
+ * `host=1` opens that one instead — a workspace there runs as the shared
+ * host account, so it is a deliberate tick in the dialog, never the default.
  */
 router.get("/browse", (req, res) => {
   // A developer browses only their own folder (by real path: a link in it
@@ -577,12 +581,22 @@ router.get("/browse", (req, res) => {
   const own = scope.ownFolder(req);
   const files = req.query.files === "1";
   const hidden = req.query.hidden === "1";
+  // An admin is not held to a folder, but starts in their own home (S3).
+  let adminHome = null;
+  if (!own && req.user?.role === "admin") {
+    try {
+      adminHome = require("../lib/run-as").accountForUser(req.user.username)?.home || null;
+    } catch {
+      // No Linux account for this admin (EMEMBERGONE): the host's home, as before.
+    }
+  }
+  const startHome = adminHome && req.query.host !== "1" ? adminHome : own || os.homedir();
   const raw =
     typeof req.query.path === "string" && req.query.path.trim()
       ? files
         ? startDir(req.query.path)
         : req.query.path
-      : own || os.homedir();
+      : startHome;
   const resolved = own ? lanesLib.canonicalCwd(path.resolve(raw)) : path.resolve(raw);
   if (own && !scope.folderAllowed(req, resolved, { allowHome: true })) return refuseFolder(res);
 
@@ -634,7 +648,13 @@ router.get("/browse", (req, res) => {
 
   const top = path.dirname(resolved) === resolved || atOwnTop;
   const parent = top ? null : path.dirname(resolved);
-  res.json({ path: resolved, parent, entries, home: own || os.homedir() });
+  res.json({
+    path: resolved,
+    parent,
+    entries,
+    home: startHome,
+    ...(adminHome ? { hostHome: os.homedir() } : {}),
+  });
 });
 
 /**