feat(server-mode): native-like folder browser, a developer kept to their own folder, no password minimum

- Folder browser (the Browse fallback for a remote browser): back/forward/up,
  a clickable breadcrumb that becomes a path field (Ctrl+L), Places (Home,
  the user's workspaces, recent picks), a filter, Name/Modified columns,
  Show hidden and New folder. A click selects; a double-click or Enter
  opens a folder or picks a file; Backspace goes up; typing jumps to a name.
- GET /api/lanes/browse: `hidden=1` (never the dot entries at the top of a
  non-admin's own folder), each entry's `mtime`, the answer's `home`.
- POST /api/lanes/browse/mkdir: one plain folder name inside an existing
  folder; a non-admin only in their own folder, none in server mode without
  one; under S3 a member's folder is made as the member.
- scope.ownFolder falls back to server.conf's USERS_ROOT under S3, so a
  settings file without AGENTHUB_USERS_ROOT no longer opens the host's home
  to every developer.
- Passwords: any non-empty password is accepted (no 8-character minimum).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/lib/auth.js

@@ -39,7 +39,6 @@ const COOKIE = "agenthub_sid";
 const SESSION_DAYS = 30;
 const ROLES = ["admin", "analyst", "developer"];
 const USERNAME_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/i;
-const MIN_PASSWORD = 8;
 
 /**
  * API prefixes whose writes change the host account's own setup. (AI Proxy
@@ -120,8 +119,9 @@ function validateUsername(name) {
 }
 
 function validatePassword(password) {
-  if (typeof password !== "string" || password.length < MIN_PASSWORD) {
-    throw err("EBADPASSWORD", `password: at least ${MIN_PASSWORD} characters`);
+  // No minimum length (the operator's choice) — only an empty one is refused.
+  if (typeof password !== "string" || password.length === 0) {
+    throw err("EBADPASSWORD", "password: required");
   }
   if (password.length > 1024) throw err("EBADPASSWORD", "password too long");
 }