feat(server-mode): native-like folder browser, a developer kept to their own folder, no password minimum

- Folder browser (the Browse fallback for a remote browser): back/forward/up,
  a clickable breadcrumb that becomes a path field (Ctrl+L), Places (Home,
  the user's workspaces, recent picks), a filter, Name/Modified columns,
  Show hidden and New folder. A click selects; a double-click or Enter
  opens a folder or picks a file; Backspace goes up; typing jumps to a name.
- GET /api/lanes/browse: `hidden=1` (never the dot entries at the top of a
  non-admin's own folder), each entry's `mtime`, the answer's `home`.
- POST /api/lanes/browse/mkdir: one plain folder name inside an existing
  folder; a non-admin only in their own folder, none in server mode without
  one; under S3 a member's folder is made as the member.
- scope.ownFolder falls back to server.conf's USERS_ROOT under S3, so a
  settings file without AGENTHUB_USERS_ROOT no longer opens the host's home
  to every developer.
- Passwords: any non-empty password is accepted (no 8-character minimum).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/SERVER-MODE.md

@@ -196,7 +196,9 @@ that already belongs to another user's workspace gets `409 EOWNED`. Admins are
 not limited. Without [one Linux user per account](#one-linux-user-per-account)
 you create each user's folder yourself, and this keeps workspaces apart, not
 agents. `install-system` sets this value to `/srv/agenthub/users`, and adding a
-user makes the folder (it is the Linux account's home).
+user makes the folder (it is the Linux account's home). With S3 installed, a
+settings file that lacks the variable falls back to `USERS_ROOT` in
+`/etc/agenthub/server.conf`, so a developer is never shown the host's home.
 
 ## What the gate does
 
@@ -222,7 +224,7 @@ user makes the folder (it is the Linux account's home).
 - A login lasts 30 days in the httpOnly, `SameSite=Strict` cookie
   `agenthub_sid`. Only the token's SHA-256 is stored. Logging out, a password
   change and disabling the user each end it.
-- Passwords are stored as scrypt hashes and must be at least 8 characters.
+- Passwords are stored as scrypt hashes; any non-empty password is accepted (no minimum length).
   Every login attempt counts before its password is checked, so attempts sent
   in parallel count too. After 10 failed logins from one address, or 30 for one
   username, in 15 minutes, further logins answer `429 ETOOMANY` until the
@@ -539,7 +541,8 @@ that are not theirs. Each case below is refused, with a test in
   line AgentHub adds for a new worktree or `.mcp.json` is written only when the
   repo's real git dir is the same account's; a FIFO there cannot hang the
   dashboard.
-- **Browsing and branch lists.** A developer's `GET /api/lanes/browse` and
+- **Browsing and branch lists.** A developer's `GET /api/lanes/browse`, the
+  browser's New folder (`POST /api/lanes/browse/mkdir`, made as the member) and
   `GET /api/lanes/branches` stay inside their own folder (`403 EFOLDER`), and
   so does a workspace's extra folder (`POST /api/lanes/:id/sources/folder`,
   refused before the path is looked at, so the answer says nothing about