feat(ai-tools): catalog of AI coding CLIs, detection, enable/default, lanes for any tool (#40 A1)

server/lib/ai-tools.js loads server/data/ai-tools/*.json (38 tools, data from
Orca, MIT) plus DASHBOARD_AI_TOOLS_DIR, detects each CLI by walking PATH, and
keeps enable/default in <data dir>/ai-tools.json. shell-path.js merges the
login shell's PATH at startup and on Refresh. /api/ai-tools lists, refreshes
and toggles; /api/run/binary resolves through the catalog.

Lanes accept any catalog id (EDISABLED for a disabled one on creation, ENOTOOL
at start once a tool left the catalog). pty-run keeps the Claude/Codex
builders and builds every other tool's argv from its catalog file, pasting an
after-start prompt through a tmux buffer; every pane gets the hydrated PATH.
A per-run bypass switch appends the catalog's bypass args (Codex included).
POST /api/run now forwards sandbox/approval/resumeLast, which it dropped.
agenthub lanes add gains --tool.

server/lib/tmux.js

@@ -137,6 +137,19 @@ function sendText(name, text) {
   execImpl(["send-keys", "-t", pane(name), "Enter"]);
 }
 
+/**
+ * Paste `text` into the pane as one bracketed paste, then press Enter. Unlike
+ * `sendText` it may span lines: the text goes into a named buffer through an
+ * argv element (`set-buffer -- <text>`), never a shell, and `-d` deletes the
+ * buffer after the paste so a prompt does not linger in tmux's buffer list.
+ */
+function pasteText(name, text) {
+  const buf = `agenthub-paste-${name}`;
+  execImpl(["set-buffer", "-b", buf, "--", text]);
+  execImpl(["paste-buffer", "-p", "-d", "-b", buf, "-t", pane(name)]);
+  execImpl(["send-keys", "-t", pane(name), "Enter"]);
+}
+
 /** Idempotent — a session that's already gone is not an error. */
 function killSession(name) {
   try {
@@ -176,6 +189,7 @@ module.exports = {
   paneCommand,
   sendCommand,
   sendText,
+  pasteText,
   killSession,
   listSessions,
   isTmuxAvailable,