chore: v2.8.15 — Oh My Pi login sharing, omp --allow-home, Markdown Preview default, first-login password

- omp-share.js: an admin's switch (S3) runs omp's own auth broker + gateway as
  the host on loopback; a member's omp pane reaches it as a scoped client keyed
  by its pane token (clients file = live omp panes only), runs on
  --model agenthub/<model>, never holds a credential.
- omp catalog: --allow-home, so a workspace at the account's home keeps its
  sessions there (they were recorded under a temp dir and dropped).
- Settings → Appearance → Open Markdown as: Preview (default) or Raw, for
  Files/Changes, the config viewer and a chat's file panel.
- First-login password change and password rules, avatar URLs, Artifacts
  "Mine" includes installed shared skills/plugins, a member's own hook pages.

server/openapi-extra/ai-tools.js

@@ -40,7 +40,8 @@ const schemas = {
       resume: { type: "boolean", description: "Offers Resume last session" },
       resumeById: {
         type: "boolean",
-        description: "Can resume a named session (Claude, Codex, a catalog `resumeById` such as omp)",
+        description:
+          "Can resume a named session (Claude, Codex, a catalog `resumeById` such as omp)",
       },
       bypass: { type: "boolean", description: "Offers the per-run Bypass permissions switch" },
       proxyCapable: { type: "boolean", description: "Can use an AI Proxy profile" },
@@ -132,6 +133,46 @@ const paths = {
       responses: ok,
     },
   },
+  "/api/ai-tools/omp-sharing": {
+    get: {
+      tags: ["AI Tools"],
+      summary: "Oh My Pi login sharing state",
+      description:
+        "Server mode with per-user accounts (S3): whether every member's omp pane runs on the HOST account's omp login through omp's own auth broker + gateway on loopback (server/lib/omp-share.js), and whether both daemons run. Never returns a token.",
+      operationId: "aiToolsOmpSharing",
+      responses: {
+        200: {
+          description:
+            "`{available, enabled, installed, broker: {running, error?}, gateway: {running, port?, error?}}`.",
+        },
+      },
+    },
+    put: {
+      tags: ["AI Tools"],
+      summary: "Turn Oh My Pi login sharing on or off",
+      description:
+        "An admin's switch (off by default). On starts `omp auth-broker serve` and `omp auth-gateway serve --clients=…` as the host; off stops them and empties the clients file, so no pane keeps a way in. Same-origin only; audited.",
+      operationId: "aiToolsSetOmpSharing",
+      requestBody: {
+        required: true,
+        content: {
+          "application/json": {
+            schema: {
+              type: "object",
+              required: ["enabled"],
+              properties: { enabled: { type: "boolean" } },
+            },
+          },
+        },
+      },
+      responses: {
+        200: { description: "The new state, as GET." },
+        400: { description: "EBADFIELD" },
+        403: { description: "Not an admin" },
+        409: { description: "ENOS3 — not server mode with per-user accounts" },
+      },
+    },
+  },
   "/api/ai-tools/{id}": {
     put: {
       tags: ["AI Tools"],

server/openapi-extra/auth.js

@@ -14,6 +14,7 @@
  *   - GET/PATCH /api/me/account, POST /api/me/password, POST /api/me/sign-out-others
  *     (Auth) — Settings → Account: the account's own profile, password and logins
  *   - GET/PUT/DELETE /api/me/avatar (Auth) — the account's own picture
+ *   - POST /api/me/avatar/url (Auth) — the same picture downloaded from a link
  *   - GET/PATCH /api/users/{id} (Auth) — the Users page's Edit user form
  *   - GET /api/users/{id}/avatar (Auth) — one account's picture (admin/analyst)
  *   - GET /api/users/tmux, POST /api/users/{id}/tmux-restart, POST /api/users/tmux-restart-idle
@@ -267,7 +268,7 @@ const paths = {
       tags: ["Auth"],
       operationId: "changeMyPassword",
       summary:
-        "Change the account's own password: the current one required (throttled); this login stays, every other ends",
+        "Change the account's own password: the current one required (throttled); the new one must pass every rule (8+ characters, lower, upper, digit, symbol, not the username) and differ from the current one; this login stays, every other ends; clears mustChangePassword",
       requestBody: {
         required: true,
         content: {
@@ -285,7 +286,7 @@ const paths = {
       },
       responses: {
         200: { description: "Changed ({ok: true})" },
-        400: err("EBADPASSWORD"),
+        400: err("EBADPASSWORD / EWEAKPASSWORD (error.rules names the failed rules)"),
         401: err("EAUTH — no login cookie (a pane token is refused)"),
         403: err("EREAUTH (current password wrong) / ELOCALMODE"),
         429: err("ETOOMANY — 10 wrong passwords in 15 minutes"),
@@ -494,6 +495,34 @@ const paths = {
       },
     },
   },
+  "/api/me/avatar/url": {
+    post: {
+      tags: ["Auth"],
+      operationId: "setMyAvatarFromUrl",
+      summary:
+        "Set the account's picture from an https link the server downloads (public addresses only, at most 3 redirects, PNG/JPEG/GIF/WebP, at most 1 MB). Login cookie only, audited",
+      requestBody: {
+        required: true,
+        content: {
+          "application/json": {
+            schema: {
+              type: "object",
+              required: ["url"],
+              properties: { url: { type: "string", format: "uri" } },
+            },
+          },
+        },
+      },
+      responses: {
+        200: { description: "Set", content: accountBody },
+        400: err("EBADURL / EPRIVATEURL / EBADIMAGE"),
+        401: err("EAUTH — no login cookie (a pane token is refused)"),
+        403: err("ELOCALMODE"),
+        413: err("ETOOBIG"),
+        502: err("EFETCH — the link could not be downloaded"),
+      },
+    },
+  },
   "/api/users/{id}/avatar": {
     get: {
       tags: ["Auth"],