fix(server): a member's test run can no longer freeze the box

On 11-02 open sessions plus test runs filled RAM and the 4 GB swap on a
slow disk; the box hung until a hard reset. Member panes now start at
nice 10, IO priority 7 and oom_score_adj 500 with Vitest capped at 2
workers by default, and the system unit caps its cgroup (server + every
pane) at 85% of RAM with 1G swap and OOMPolicy=continue, so the kernel
kills the biggest pane process instead of hanging the machine. Needs
`agenthub server install-system` once.

docs/SERVER-MODE.md

@@ -1156,6 +1156,27 @@ The same re-run installs `agenthub-provision delete`, behind the Users page's
 **Delete user**: until then a delete answers `502 EPROVISION` ("unknown
 action: delete") and changes nothing.
 
+The same re-run (v2.8.68) keeps a member's test run from freezing the box —
+on 11-02 some 36 open sessions plus test runs filled RAM and the 4 GB swap on
+a slow disk, and only a hard reset brought it back:
+
+- `pane-launch` starts every member pane at `nice 10`, best-effort IO
+  priority 7 and `oom_score_adj 500`, and defaults `VITEST_MAX_THREADS` /
+  `VITEST_MAX_FORKS` to 2 (Vitest ≤ 3; a member may set their own). Only
+  panes started after the re-run get these; the nice cannot be taken back
+  without root.
+- `agenthub.service` gets `MemoryMax=85%`, `MemorySwapMax=1G`,
+  `OOMPolicy=continue` and `OOMScoreAdjust=-100`. The cgroup holds the server
+  AND every member pane, so memory runs out inside the unit first, and the
+  kernel kills the biggest pane process there — not the dashboard, tmux, or
+  the rest of the machine. `daemon-reload` (which the re-run does) applies
+  the memory caps to the running unit; `OOMScoreAdjust` takes effect at the
+  next restart (`sudo -n /usr/bin/systemctl restart --no-block
+  agenthub.service` — panes survive, `KillMode=process`).
+
+Check with `systemctl show agenthub.service -p MemoryMax,MemorySwapMax,OOMPolicy`
+and, in a new member pane, `ps -o ni= -p $$; cat /proc/self/oom_score_adj`.
+
 ### Deleting a user
 
 Users page → Edit → **Delete user** (the admin's own password, then a red