feat(server-s3): one Linux user per account (S3) — experimental

Server mode can now run each account as its own Linux user (ah-<name>)
when `agenthub server install-system` has set S3 up. The dashboard
reaches a member only through sudo -u / write-as / pane-launch, reads a
member's files only through owner- and type-checked opens, and hooks
are authenticated by peer uid. Local mode and server mode without S3
are unchanged.

EXPERIMENTAL: tested with fake sudo and fake accounts only. It has not
yet been verified on a real install with real member accounts, sudo or
a real Codex login. Do not offer it to real users yet.

- S3 core: provisioning, per-member tmux servers, the proxy key
  gateway, shared tools in /opt, dropped capabilities for children
  (P0–P5)
- P4: plan and quota per member home
- P6: ~/.claude.json seed; opt-in plugin baseline installed as the
  member; managed-settings spike script (not run)
- P7: Codex account pool (`agenthub accounts add --tool codex`)
- Roles merged with main's admin / analyst / developer: analysts write
  only their own rows, under S3 as well
- Per-account prefs: one implementation (Chat UI + onboarding)
- Security reviews F1–F49 (five rounds), each fix with a regression
  test: symlink/TOCTOU-safe member reads, no host writes in a member
  home, credentials and the data dir never served, owner and folder
  account must agree, pane tokens bound to the pane's uid, bounded
  sudo/tmux/git calls and member reads (no hang or crash from a member),
  async route rejections answer 500 instead of exiting
- Docs: docs/SERVER-MODE.md (S3 model, accepted ceilings, operator
  runbook), docs/plans/server-mode/S3-PLAN.md, CLAUDE.md S3 rules

Tests: server 2838/2841 (3 need 127.0.0.1:3000, held on this box);
client 1162/1162; tsc clean; headers check passes.

Co-Authored-By: Claude <noreply@anthropic.com>

client/src/components/settings/AppearanceSettings.tsx

@@ -10,6 +10,7 @@
  * own element (`dark` class or `data-mode`, plus `data-theme`), so the preview
  * is painted by the same tokens as the app — no hex is duplicated here.
  * **Reset to defaults** (after a confirm) returns to Dark with both stock themes.
+ * **Run setup again** reopens the first-run wizard (`components/onboarding`).
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
@@ -21,6 +22,7 @@ import { PetSettings } from "./PetSettings";
 import { ChatUiSettings } from "./ChatUiSettings";
 import { THEMES, useTheme, type Theme, type ThemeMode } from "../../hooks/useTheme";
 import { confirmDialog } from "../../lib/confirm";
+import { resetOnboarding } from "../../lib/userPrefs";
 import { toast } from "../../lib/toast";
 import {
   TERMINAL_FONTS,
@@ -29,7 +31,7 @@ import {
   type TerminalFont,
 } from "../../lib/terminalFont";
 
-const THEME_LABELS: Record<string, string> = {
+export const THEME_LABELS: Record<string, string> = {
   darcula: "Darcula",
   "apple-dark": "Apple Dark",
   "apple-light": "Apple Light",
@@ -44,7 +46,7 @@ const MODES: { mode: ThemeMode; Icon: typeof Moon }[] = [
   { mode: "system", Icon: Monitor },
 ];
 
-function Swatch({ mode, name }: { mode: Theme; name: string }) {
+export function Swatch({ mode, name }: { mode: Theme; name: string }) {
   return (
     <div
       aria-hidden
@@ -221,6 +223,26 @@ export function AppearanceSettings() {
         </div>
         <PetSettings />
       </section>
+
+      <SettingsSection
+        id="setup"
+        title={t("onboarding:rerun.label")}
+        description={t("onboarding:rerun.description")}
+      >
+        <SettingsRow
+          label={t("onboarding:rerun.label")}
+          control={
+            <button
+              type="button"
+              onClick={resetOnboarding}
+              data-testid="rerun-setup"
+              className="btn-ghost border border-border text-xs"
+            >
+              {t("onboarding:rerun.button")}
+            </button>
+          }
+        />
+      </SettingsSection>
     </div>
   );
 }