feat(settings): admin switch to allow or block members' test runs

Settings → AI tools → Tests on this server (admin, S3 only). Stored in
/opt/agenthub/app/member-policy.json, which member-guard.js reads as the
member at each Bash call — no restart; no file = blocked. GET/PUT
/api/ai-tools/member-policy, audited, 409 ENOS3 outside S3.

docs/SERVER-MODE.md

@@ -1179,6 +1179,10 @@ tests run on each member's own machine:
   `npm run test:*`, `php artisan test`, `go test`, `cargo test`, `docker`,
   `podman`, … and tells Claude to leave testing to the member's machine.
   A person typing a command in a Terminal tab, and Codex, are not covered.
+  An admin can allow them again with **Settings → AI tools → Tests on this
+  server** (`PUT /api/ai-tools/member-policy` `{allowTests}`, kept in
+  `/opt/agenthub/app/member-policy.json`, no file = blocked); it takes effect
+  at members' next Bash call, no restart.
 - **At most 4 AI sessions per member at once** (`MAX_AI_SESSIONS=<n>` in
   `/etc/agenthub/server.conf`, `0` = no limit). Counted from the account's
   running processes (`server/lib/ai-procs.js`: `claude`, `codex`, `agy`,