feat(server-s3): one Linux user per account (S3) — experimental

Server mode can now run each account as its own Linux user (ah-<name>)
when `agenthub server install-system` has set S3 up. The dashboard
reaches a member only through sudo -u / write-as / pane-launch, reads a
member's files only through owner- and type-checked opens, and hooks
are authenticated by peer uid. Local mode and server mode without S3
are unchanged.

EXPERIMENTAL: tested with fake sudo and fake accounts only. It has not
yet been verified on a real install with real member accounts, sudo or
a real Codex login. Do not offer it to real users yet.

- S3 core: provisioning, per-member tmux servers, the proxy key
  gateway, shared tools in /opt, dropped capabilities for children
  (P0–P5)
- P4: plan and quota per member home
- P6: ~/.claude.json seed; opt-in plugin baseline installed as the
  member; managed-settings spike script (not run)
- P7: Codex account pool (`agenthub accounts add --tool codex`)
- Roles merged with main's admin / analyst / developer: analysts write
  only their own rows, under S3 as well
- Per-account prefs: one implementation (Chat UI + onboarding)
- Security reviews F1–F49 (five rounds), each fix with a regression
  test: symlink/TOCTOU-safe member reads, no host writes in a member
  home, credentials and the data dir never served, owner and folder
  account must agree, pane tokens bound to the pane's uid, bounded
  sudo/tmux/git calls and member reads (no hang or crash from a member),
  async route rejections answer 500 instead of exiting
- Docs: docs/SERVER-MODE.md (S3 model, accepted ceilings, operator
  runbook), docs/plans/server-mode/S3-PLAN.md, CLAUDE.md S3 rules

Tests: server 2838/2841 (3 need 127.0.0.1:3000, held on this box);
client 1162/1162; tsc clean; headers check passes.

Co-Authored-By: Claude <noreply@anthropic.com>

client/src/i18n/locales/en/onboarding.json

@@ -0,0 +1,95 @@
+{
+  "brand": "AgentHub",
+  "progress": "{{n}} of {{total}}",
+  "skip": "Skip setup",
+  "back": "Back",
+  "continue": "Continue",
+  "finish": "Add your first workspace",
+  "agent": {
+    "eyebrow": "Welcome to AgentHub",
+    "title": "Pick your default agent",
+    "body": "AgentHub works with every CLI agent. Choose the one you'll reach for most. Switch any time.",
+    "detected": "Detected on this machine · {{count}}",
+    "none": "No AI tool is installed yet. An admin installs them in Settings → AI Tools; you can finish setup and pick one later.",
+    "more": "Show {{count}} more agents",
+    "less": "Show fewer",
+    "notInstalled": "not installed",
+    "permission": "Start new sessions in",
+    "permissionHint": "Bypass permissions is never a default: it stays a red switch you turn on for one session.",
+    "modes": {
+      "auto": "Auto",
+      "acceptEdits": "Accept edits",
+      "default": "Ask first",
+      "plan": "Plan"
+    }
+  },
+  "look": {
+    "title": "Make it feel like home",
+    "body": "Pick the look you want to stare at for hours.",
+    "modes": {
+      "system": "System",
+      "dark": "Dark",
+      "light": "Light"
+    },
+    "modeHints": {
+      "system": "Match OS",
+      "dark": "Easy on the eyes",
+      "light": "Bright & crisp"
+    },
+    "darkThemes": "Dark theme",
+    "lightThemes": "Light theme",
+    "language": "Language",
+    "font": "Terminal font",
+    "more": "More options — themes, fonts, the pet — in Settings → Appearance."
+  },
+  "pet": {
+    "title": "Pick a companion",
+    "body": "A small pet sits in the corner and reacts to what your agents do. Hide it any time."
+  },
+  "notify": {
+    "title": "Set up notifications",
+    "body": "AgentHub tells you when agents are done or need you.",
+    "enable": "Desktop notifications",
+    "enableHint": "Your browser asks for permission once.",
+    "blocked": "Notifications are blocked for this site — allow them in the browser's site settings.",
+    "sound": "Notification sound",
+    "preview": "Play",
+    "test": "Send test notification"
+  },
+  "tour": {
+    "progress": "Step {{n}} of {{total}}",
+    "skip": "Skip tour",
+    "next": "Next",
+    "done": "Done",
+    "goWorkspaces": "Go to Workspaces",
+    "add": {
+      "title": "Create your first workspace",
+      "body": "A workspace is one project folder where your agents work. Click here to add one."
+    },
+    "folder": {
+      "title": "Choose the project folder",
+      "body": "Type a path or Browse to the folder of your project. A git repository gets a Changes panel too."
+    },
+    "create": {
+      "title": "Create it",
+      "body": "Pick the AI it starts on, then click Add workspace."
+    },
+    "prompt": {
+      "title": "Start your first session",
+      "body": "Tell the agent what to do and press Enter. AI, model and permission mode sit right here."
+    },
+    "session": {
+      "title": "Your session is live",
+      "body": "Watch it work and type into it like a terminal. Changes and Files are in the panel on the right; every session of this workspace is listed in the sidebar."
+    },
+    "finish": {
+      "title": "You're all set",
+      "body": "Run setup again or change any of it in Settings."
+    }
+  },
+  "rerun": {
+    "label": "First-run setup",
+    "description": "Go through the welcome steps and the tour again.",
+    "button": "Run setup again"
+  }
+}