feat(ai-tools): catalog of AI coding CLIs, detection, enable/default, lanes for any tool (#40 A1)

server/lib/ai-tools.js loads server/data/ai-tools/*.json (38 tools, data from
Orca, MIT) plus DASHBOARD_AI_TOOLS_DIR, detects each CLI by walking PATH, and
keeps enable/default in <data dir>/ai-tools.json. shell-path.js merges the
login shell's PATH at startup and on Refresh. /api/ai-tools lists, refreshes
and toggles; /api/run/binary resolves through the catalog.

Lanes accept any catalog id (EDISABLED for a disabled one on creation, ENOTOOL
at start once a tool left the catalog). pty-run keeps the Claude/Codex
builders and builds every other tool's argv from its catalog file, pasting an
after-start prompt through a tmux buffer; every pane gets the hydrated PATH.
A per-run bypass switch appends the catalog's bypass args (Codex included).
POST /api/run now forwards sandbox/approval/resumeLast, which it dropped.
agenthub lanes add gains --tool.

server/__tests__/lanes-api.test.js

@@ -1441,7 +1441,7 @@ describe("/api/lanes tool tests", () => {
   it("POST /api/lanes/ensure rejects an unknown tool", async () => {
     const res = await request("POST", "/api/lanes/ensure", {
       cwd: "/tmp/bad-tool",
-      tool: "cursor",
+      tool: "not-a-tool",
     });
     assert.equal(res.status, 400);
     assert.equal(res.body.error.code, "EBADTOOL");
@@ -1595,7 +1595,7 @@ describe("/api/lanes tool tests", () => {
 
     const badRes = await request("POST", "/api/lanes/ensure", {
       cwd: "/tmp/dual-invalid-tool-cwd",
-      tool: "cursor", // invalid
+      tool: "not-a-tool", // invalid
     });
     assert.equal(badRes.status, 400);
     assert.equal(badRes.body.error.code, "EBADTOOL");