docs: OpenAPI and API.md cover every route; drop removed endpoints; guard config writes

- openapi-extra/run.js describes tmux pane runs only: the removed
  POST /api/run/{id}/message and stream-json run_stream/run_input_ack are gone.
- 108 operations added to OpenAPI (lanes, run, settings, reports, cc-config,
  pets, ai-proxies, tool-profiles, ai-tools, snapshots, locks, ...);
  openapi.yaml regenerated.
- docs/API.md: 74 routes added, 4 endpoints that no longer exist removed.
- Role is `developer`, not `member` (CLI.md, DATABASE.md, OVERVIEW.md);
  `agenthub update` -> `update-check`; help lists `server install-system|tools`
  and `users provision`; ARCHITECTURE.md's stale paths and names fixed.
- cc-config/codex-config writes carry sameOriginGuard (an MCP server or plugin
  is code Claude runs later), with a test; `command -v` takes its name as $1.

server/__tests__/api.test.js

@@ -94,7 +94,6 @@ const EXPECTED_API_PATHS = [
   "/api/run/files",
   "/api/run/binary",
   "/api/run/{id}",
-  "/api/run/{id}/message",
   "/api/webhooks",
   "/api/webhooks/providers",
   "/api/webhooks/{id}",

server/__tests__/cc-config.test.js

@@ -1215,4 +1215,15 @@ describe("/api/cc-config", () => {
     assert.equal(status, 400);
     assert.equal(body.error.code, "EBADARG");
   });
+
+  it("refuses a write from a foreign origin before it reaches the CLI", async () => {
+    for (const p of ["/api/cc-config/mcp/add", "/api/cc-config/plugins/install"]) {
+      const { status } = await fetchJson(p, {
+        method: "POST",
+        body: { name: "x", command: "true", plugin: "x@y" },
+        headers: { Origin: "https://evil.example" },
+      });
+      assert.equal(status, 403, p);
+    }
+  });
 });