docs: OpenAPI and API.md cover every route; drop removed endpoints; guard config writes

- openapi-extra/run.js describes tmux pane runs only: the removed
  POST /api/run/{id}/message and stream-json run_stream/run_input_ack are gone.
- 108 operations added to OpenAPI (lanes, run, settings, reports, cc-config,
  pets, ai-proxies, tool-profiles, ai-tools, snapshots, locks, ...);
  openapi.yaml regenerated.
- docs/API.md: 74 routes added, 4 endpoints that no longer exist removed.
- Role is `developer`, not `member` (CLI.md, DATABASE.md, OVERVIEW.md);
  `agenthub update` -> `update-check`; help lists `server install-system|tools`
  and `users provision`; ARCHITECTURE.md's stale paths and names fixed.
- cc-config/codex-config writes carry sameOriginGuard (an MCP server or plugin
  is code Claude runs later), with a test; `command -v` takes its name as $1.

server/openapi-extra.js

@@ -20,6 +20,11 @@ const misc = require("./openapi-extra/misc");
 const auth = require("./openapi-extra/auth");
 const files = require("./openapi-extra/files");
 const artifacts = require("./openapi-extra/artifacts");
+// Routes the spec had missed (audit 2026-10-22): new path keys only — a key
+// that already existed got its missing method in place instead.
+const lanesMore = require("./openapi-extra/lanes-more");
+const toolsMore = require("./openapi-extra/tools-more");
+const opsMore = require("./openapi-extra/ops-more");
 // Enriched overrides of already-documented endpoints — same operationId, tags,
 // and request/response `$ref` schemas as the base, with added examples and
 // richer descriptions. Listed last so they win the merge.
@@ -58,6 +63,9 @@ module.exports = combine(
   auth,
   files,
   artifacts,
+  lanesMore,
+  toolsMore,
+  opsMore,
   overrideSessionsAgents,
   overrideCore,
   overridePricingAlerts,