docs: OpenAPI and API.md cover every route; drop removed endpoints; guard config writes

- openapi-extra/run.js describes tmux pane runs only: the removed
  POST /api/run/{id}/message and stream-json run_stream/run_input_ack are gone.
- 108 operations added to OpenAPI (lanes, run, settings, reports, cc-config,
  pets, ai-proxies, tool-profiles, ai-tools, snapshots, locks, ...);
  openapi.yaml regenerated.
- docs/API.md: 74 routes added, 4 endpoints that no longer exist removed.
- Role is `developer`, not `member` (CLI.md, DATABASE.md, OVERVIEW.md);
  `agenthub update` -> `update-check`; help lists `server install-system|tools`
  and `users provision`; ARCHITECTURE.md's stale paths and names fixed.
- cc-config/codex-config writes carry sameOriginGuard (an MCP server or plugin
  is code Claude runs later), with a test; `command -v` takes its name as $1.

server/routes/codex-config.js

@@ -135,7 +135,7 @@ router.get("/file", (req, res) => {
 // anywhere on disk (same reasoning cc-config.js's PATCH /settings gives for
 // refusing `?cwd=` there). Reads keep the override.
 
-router.put("/file", (req, res) => {
+router.put("/file", sameOriginGuard, (req, res) => {
   const { scope, type, name, content } = req.body || {};
   if (typeof scope !== "string" || typeof type !== "string") {
     return res
@@ -151,7 +151,7 @@ router.put("/file", (req, res) => {
   }
 });
 
-router.delete("/file", (req, res) => {
+router.delete("/file", sameOriginGuard, (req, res) => {
   const { scope, type, name } = req.body || {};
   if (typeof scope !== "string" || typeof type !== "string") {
     return res
@@ -282,7 +282,7 @@ router.get("/marketplaces", async (_req, res) => {
   }
 });
 
-router.post("/mcp/add", async (req, res) => {
+router.post("/mcp/add", sameOriginGuard, async (req, res) => {
   try {
     const result = await codexCli.mcpAdd(req.body || {});
     return cliResult(res, result, { action: "add", type: "mcp", name: (req.body || {}).name });
@@ -291,7 +291,7 @@ router.post("/mcp/add", async (req, res) => {
   }
 });
 
-router.post("/mcp/remove", async (req, res) => {
+router.post("/mcp/remove", sameOriginGuard, async (req, res) => {
   const { name } = req.body || {};
   try {
     const result = await codexCli.mcpRemove(name);
@@ -306,7 +306,7 @@ const PLUGIN_ACTIONS = {
   remove: codexCli.pluginRemove,
 };
 
-router.post("/plugins/action", async (req, res) => {
+router.post("/plugins/action", sameOriginGuard, async (req, res) => {
   const { spec, action } = req.body || {};
   const run = PLUGIN_ACTIONS[action];
   if (!run) {
@@ -325,7 +325,7 @@ router.post("/plugins/action", async (req, res) => {
   }
 });
 
-router.post("/marketplaces/add", async (req, res) => {
+router.post("/marketplaces/add", sameOriginGuard, async (req, res) => {
   const { url } = req.body || {};
   try {
     const result = await codexCli.marketplaceAdd(url);
@@ -339,7 +339,7 @@ const MARKETPLACE_ACTIONS = {
   remove: codexCli.marketplaceRemove,
 };
 
-router.post("/marketplaces/action", async (req, res) => {
+router.post("/marketplaces/action", sameOriginGuard, async (req, res) => {
   const { name, action } = req.body || {};
   const run = MARKETPLACE_ACTIONS[action];
   if (!run) {