feat(health): System Health in three groups, a score that sees lag; admin user detail

Dashboard → System Health is grouped into AgentHub, Machine and Agent
activity. The machine (GET /api/host, every signed-in user) is drawn by
components/health/HostHealth.tsx: host card beside the CPU/memory history,
then CPU (threads as compact cells + temperatures/GPUs), disks & network,
busiest processes, and per-user tiles. Concurrency bars each show their own
agent type on hover.

The Health Score (client/src/lib/healthScore.ts) is now 100 minus what each
check costs, between an amber and a red threshold: event-loop p99
(server/lib/loop-delay.js, shared with /api/metrics), Linux PSI pressure for
CPU, memory and disk I/O (/api/host `pressure`; load per core without PSI),
RAM, the database's disk, V8 heap, hooks silent while agents work, and agent
errors in the last 24 h. All-time success rate, API errors and the transcript
cache hit rate no longer count. /api/settings/info adds server.event_loop and
activity {last_event_at, working_agents, agents_24h}.

Administration: a user row opens its detail in place (GET
/api/users/:id/details — spend, account pool share, live panes, workspaces,
newest sessions); the server panel is gone, member tmux folded into the table;
the Sessions list shows each row's owner in server mode.

client/src/pages/__tests__/Users.test.tsx

@@ -6,7 +6,9 @@
  * a wrong password reported in the edit dialog, opens ONE Edit per row (no
  * separate role/password/workspace/disable buttons any more), and sees the
  * display name and email under a username; right-clicking a row opens that
- * user's home in Files (an admin) — an analyst's menu only copies.
+ * user's home in Files (an admin) — an analyst's menu only copies; clicking a
+ * user's name expands their detail under the row (`?user=`), with spend and
+ * pool share, and a second click folds it.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
@@ -41,6 +43,8 @@ const users = vi.hoisted(() => ({
   setPassword: vi.fn(),
   assignWorkspace: vi.fn(),
   get: vi.fn(),
+  details: vi.fn(),
+  avatarUrl: vi.fn(),
   // No S3 here: the members' tmux card stays hidden.
   tmux: vi.fn(async () => ({ available: false, users: [] })),
 }));
@@ -96,7 +100,76 @@ beforeEach(() => {
   }));
 });
 
+const details = {
+  user: {
+    id: 2,
+    username: "mia",
+    role: "developer",
+    disabled: false,
+    displayName: "Mia Tran",
+    logins: 1,
+    lastLoginAt: null,
+  },
+  sessions: { total: 3, active: 1, firstAt: null, lastAt: null },
+  usage: {
+    today: { cost: 1, tokens: 10 },
+    last7d: { cost: 2, tokens: 20 },
+    last30d: { cost: 4, tokens: 40 },
+    daily: [{ date: "2026-10-27", cost: 4, tokens: 40 }],
+    byTool: [{ key: "codex", cost: 4, tokens: 40, sessions: 1 }],
+    byModel: [{ key: "gpt-5.5", cost: 4, tokens: 40, sessions: 1 }],
+  },
+  workspaces: [],
+  panes: [],
+  recentSessions: [],
+  pool: {
+    claude: {
+      pin: "team-1",
+      group: null,
+      accounts: [
+        {
+          name: "team-1",
+          kind: "token",
+          email: null,
+          expired: false,
+          allowed: true,
+          pinned: true,
+          quota: null,
+          quotaPercent: null,
+          full: false,
+          livePanes: 0,
+          spend5h: 0,
+          spend7d: 10,
+          userSpend5h: 0,
+          userSpend7d: 2.5,
+          userTokens5h: 0,
+          userTokens7d: 99,
+          userRuns7d: 2,
+          userLivePanes: 0,
+          userLastAt: null,
+        },
+      ],
+    },
+  },
+  audit: [],
+};
+
 describe("Users page", () => {
+  it("expands a user's detail under their row, and folds it again", async () => {
+    authState = { mode: "server", user: { id: 1, username: "boss", role: "admin" } };
+    users.details.mockResolvedValue(details);
+    renderPage();
+    fireEvent.click(await screen.findByRole("button", { name: "mia" }));
+    const pool = await screen.findByTestId("user-pool-account");
+    expect(users.details).toHaveBeenCalledWith(2);
+    const page = screen.getByTestId("user-detail");
+    expect(within(screen.getByTestId("users-table")).getByTestId("user-detail")).toBe(page);
+    expect(within(pool).getByText("team-1")).toBeTruthy();
+    expect(within(pool).getByText(/25%/)).toBeTruthy();
+    fireEvent.click(screen.getByRole("button", { name: "mia" }));
+    await waitFor(() => expect(screen.queryByTestId("user-detail")).toBeNull());
+  });
+
   it("sends local mode and a member home", async () => {
     authState = { mode: "local" };
     renderPage();