feat(settings): admin switch to allow or block members' test runs

Settings → AI tools → Tests on this server (admin, S3 only). Stored in
/opt/agenthub/app/member-policy.json, which member-guard.js reads as the
member at each Bash call — no restart; no file = blocked. GET/PUT
/api/ai-tools/member-policy, audited, 409 ENOS3 outside S3.

server/openapi-extra/ai-tools.js

@@ -173,6 +173,43 @@ const paths = {
       },
     },
   },
+  "/api/ai-tools/member-policy": {
+    get: {
+      tags: ["AI Tools"],
+      summary: "What members' Claude may run on this server",
+      description:
+        "Server mode with per-user accounts (S3): whether members' Claude may run test runners and container commands (`allowTests`, off by default). Kept in `/opt/agenthub/app/member-policy.json` and enforced by the members' synchronous PreToolUse hook (scripts/member-guard.js).",
+      operationId: "aiToolsMemberPolicy",
+      responses: {
+        200: { description: "`{available, allowTests}`." },
+      },
+    },
+    put: {
+      tags: ["AI Tools"],
+      summary: "Allow or block members' test runs",
+      description:
+        "An admin's switch. Takes effect at the next Bash call of every member's Claude, no restart. Same-origin only; audited.",
+      operationId: "aiToolsSetMemberPolicy",
+      requestBody: {
+        required: true,
+        content: {
+          "application/json": {
+            schema: {
+              type: "object",
+              required: ["allowTests"],
+              properties: { allowTests: { type: "boolean" } },
+            },
+          },
+        },
+      },
+      responses: {
+        200: { description: "The new state, as GET." },
+        400: { description: "EBADFIELD" },
+        403: { description: "Not an admin" },
+        409: { description: "ENOS3 — not server mode with per-user accounts" },
+      },
+    },
+  },
   "/api/ai-tools/{id}": {
     put: {
       tags: ["AI Tools"],