feat: v2.7.8 — Artifacts hub, clone related repos as extra folders, quieter resume prompt

- Artifacts (/artifacts): claude.ai pages sessions publish (captured from the
  Artifact tool's hook), pinned workspace files, skills and plugins, each
  kept as a snapshot; shared ones appear in a Hub and a skill or plugin
  installs into the viewer's own account (server/lib/artifacts.js,
  /api/artifacts, docs/plans/artifacts/).
- Workspace extra folders: clone one or more related repos beside the
  workspace and add them in one step (POST /api/lanes/:id/sources/clone).
- A pane that ended by itself while tmux kept running is no longer offered
  for resume (tmux.serverStartedAt in reconcileOrphans).
- Changes panel: a folder that is not a git repo opens on Files, and its
  files open from there.
- Plus the parallel sessions' work in this tree: File Explorer button in the
  panel header, user delete, RSA SSH keys, chat/terminal and pet fixes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/routes/users.js

@@ -102,6 +102,7 @@ const STATUS = {
   EEXISTS: 409,
   ESELF: 409,
   EOWNERFOLDER: 409, // S3: a workspace in one member's home, assigned to another
+  ELASTADMIN: 409,
   ETOOMANY: 429,
   // S3: the Linux account could not be created/locked (the helper said why).
   EPROVISION: 502,
@@ -248,6 +249,27 @@ router.patch(
   })
 );
 
+/**
+ * Delete a user for good (auth.deleteUser): their logins, panes, workspaces'
+ * records and — under S3 — their Linux account and whole home. Never
+ * yourself (ESELF) or the last admin (ELASTADMIN); the admin's password
+ * again, like every account change, and written to the audit log.
+ */
+router.delete(
+  "/:id",
+  accountChange(async (req) => {
+    const u = target(req);
+    if (u.id === req.user.id) {
+      throw Object.assign(new Error("you cannot delete yourself"), { code: "ESELF" });
+    }
+    const gone = auth.deleteUser(u.username);
+    return {
+      user: auth.publicUser(u),
+      action: `delete ${u.username} (${gone.workspaces} workspace(s), home removed)`,
+    };
+  })
+);
+
 router.post(
   "/:id/password",
   accountChange(async (req, body) => {