fix: event-loop freezes, plugin-install boot crash, tmux attach/scrollbar, Codex transcripts

- GET /api/workflows: one LEAD() window pass in a read worker (read-pool.js,
  workflow-stats.js); idx_events_session restored, idx_events_tool added
- compat-sqlite gains function/pluck/readonly so a plugin install without a
  better-sqlite3 build boots again; antigravity-usage uses db.js's Database
- install-hooks adds no checkout hooks while the agenthub plugin is enabled
  (events were doubled)
- terminal attach runs the live tmux server's own binary; the pane scrollbar
  gets a visible 2-column style, and claude panes start with
  CLAUDE_CODE_DISABLE_ALTERNATE_SCREEN=1 so tmux keeps history to scroll
- Codex sessions' conversation in GET /api/sessions/:id/transcript
- Codex/Antigravity sessions claimed by their workspace without hooks
- UI-audit follow-ups, docs and OpenAPI

bin/agenthub.js

@@ -167,11 +167,13 @@ async function api(method, pathname, body, options = {}) {
   const url = `${baseUrl()}${pathname}`;
   let res;
   try {
+    // A FormData body (a file upload) sets its own multipart Content-Type.
+    const form = body instanceof FormData;
     res = await fetch(url, {
       method,
-      headers: body ? { "Content-Type": "application/json" } : undefined,
-      body: body ? JSON.stringify(body) : undefined,
-      signal: AbortSignal.timeout(30_000),
+      headers: body && !form ? { "Content-Type": "application/json" } : undefined,
+      body: body ? (form ? body : JSON.stringify(body)) : undefined,
+      signal: AbortSignal.timeout(options.timeoutMs ?? 30_000),
     });
   } catch {
     throw new ServerDownError();
@@ -1340,8 +1342,8 @@ async function cmdExport(positional) {
 }
 
 // Restore a bundle produced by `agenthub export` (or the dashboard's Export data).
-// The local server reads the file from disk, so we pass an absolute path rather
-// than uploading — idempotent and non-destructive (existing sessions skipped).
+// Uploaded like the dashboard's Restore button does — the server never reads a
+// path from a request. Idempotent and non-destructive (existing sessions skipped).
 async function cmdImportData(positional) {
   const target = positional[0];
   if (!target) {
@@ -1353,7 +1355,9 @@ async function cmdImportData(positional) {
     console.error(c.red(`✖ File not found: ${abs}`));
     process.exit(1);
   }
-  const r = await post("/api/settings/import", { path: abs });
+  const form = new FormData();
+  form.append("file", new Blob([fs.readFileSync(abs)]), path.basename(abs));
+  const r = await post("/api/settings/import", form, { timeoutMs: 10 * 60_000 });
   console.log(
     `${c.green("✔")} Restored: ${r.sessions_imported ?? 0} sessions added, ` +
       `${r.sessions_skipped ?? 0} already present, ${r.events ?? 0} events, ` +