fix(server-mode): close the gaps the review of workspace sharing found

- A Terminal tab a collaborator opens records them (dashboard_runs.started_by):
  its pane token acts as them — and only while still shared with them —
  never as the workspace owner (userFromPaneToken).
- POST /api/run always starts the lane's AI tool: a collaborator gets
  ECOLLABSTART whatever the body says (shell: true no longer slips past).
- A collaborator disabled since no longer locks the share list: kept on it
  (shown disabled) or taken off; only a new addition must be enabled.
- The workspace home tells a collaborator to open an existing session and
  keeps Start disabled instead of failing on every submit.

docs/API.md

@@ -2111,7 +2111,10 @@ owner or an admin only (`403 ENOTOWNER`), same-origin, each change audited. Loca
 mode: `GET` answers an empty list, `PUT` `400 ELOCALMODE`. A user it is shared with
 sees and works in it like its owner, but `PATCH {title}`, `reset`/`remove`/`purge`,
 `DELETE` and `PUT …/shares` answer them `403 ENOTOWNER`, and a non-shell
-`POST /api/lanes/:id/start` or `POST /api/run` `403 ECOLLABSTART`. Users taken off
+`POST /api/lanes/:id/start` or any `POST /api/run` `403 ECOLLABSTART`. A Terminal
+tab they open (`start {shell: true}`) records them in `dashboard_runs.started_by`:
+its pane token acts as them, not the owner. A user disabled since stays on the
+list (`disabled: true`) and may be kept or removed; only a new one must be enabled. Users taken off
 get the WebSocket message `lane_access` `{laneId, userIds}` (sent to them only). See
 `docs/SERVER-MODE.md` → Sharing a workspace.