feat(server-mode): native-like folder browser, a developer kept to their own folder, no password minimum

- Folder browser (the Browse fallback for a remote browser): back/forward/up,
  a clickable breadcrumb that becomes a path field (Ctrl+L), Places (Home,
  the user's workspaces, recent picks), a filter, Name/Modified columns,
  Show hidden and New folder. A click selects; a double-click or Enter
  opens a folder or picks a file; Backspace goes up; typing jumps to a name.
- GET /api/lanes/browse: `hidden=1` (never the dot entries at the top of a
  non-admin's own folder), each entry's `mtime`, the answer's `home`.
- POST /api/lanes/browse/mkdir: one plain folder name inside an existing
  folder; a non-admin only in their own folder, none in server mode without
  one; under S3 a member's folder is made as the member.
- scope.ownFolder falls back to server.conf's USERS_ROOT under S3, so a
  settings file without AGENTHUB_USERS_ROOT no longer opens the host's home
  to every developer.
- Passwords: any non-empty password is accepted (no 8-character minimum).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

client/src/lib/api.ts

@@ -2971,19 +2971,39 @@ export const api = {
      * filesystem paths from a native picker, so this drives a server-backed one.
      * @param path Absolute path to list; defaults server-side to the home dir.
      * @param files List files too (`file: true`) — a file field's picker.
-     * @returns `{ path, parent, entries }` — `parent` is null at the root.
+     * @param hidden List dot entries too (never at the top of a member's home).
+     * @returns `{ path, parent, entries, home }` — `parent` is null at the
+     *   root, `home` is the folder the browser's Home place opens.
      */
-    browse: (path?: string, files?: boolean) => {
+    browse: (path?: string, files?: boolean, hidden?: boolean) => {
       const q = new URLSearchParams();
       if (path) q.set("path", path);
       if (files) q.set("files", "1");
+      if (hidden) q.set("hidden", "1");
       const qs = q.toString();
       return request<{
         path: string;
         parent: string | null;
-        entries: { name: string; path: string; isGitRepo: boolean; file?: boolean }[];
+        home?: string;
+        entries: {
+          name: string;
+          path: string;
+          isGitRepo: boolean;
+          file?: boolean;
+          mtime?: number | null;
+        }[];
       }>(`/lanes/browse${qs ? `?${qs}` : ""}`);
     },
+    /**
+     * POST /api/lanes/browse/mkdir — the folder browser's New folder: one
+     * folder `name` inside `parent`. Throws `.code` `EBADNAME`, `EEXISTS`,
+     * `EFOLDER` (outside the caller's own folder).
+     */
+    mkdir: (parent: string, name: string) =>
+      request<{ path: string }>("/lanes/browse/mkdir", {
+        method: "POST",
+        body: JSON.stringify({ parent, name }),
+      }),
     /**
      * POST /api/lanes/pick-path — open the OS's own folder/file picker on the
      * server's desktop and wait for the user. Throws `.code` `EREMOTE` (not a