feat(server-s3): one Linux user per account (S3) — experimental

Server mode can now run each account as its own Linux user (ah-<name>)
when `agenthub server install-system` has set S3 up. The dashboard
reaches a member only through sudo -u / write-as / pane-launch, reads a
member's files only through owner- and type-checked opens, and hooks
are authenticated by peer uid. Local mode and server mode without S3
are unchanged.

EXPERIMENTAL: tested with fake sudo and fake accounts only. It has not
yet been verified on a real install with real member accounts, sudo or
a real Codex login. Do not offer it to real users yet.

- S3 core: provisioning, per-member tmux servers, the proxy key
  gateway, shared tools in /opt, dropped capabilities for children
  (P0–P5)
- P4: plan and quota per member home
- P6: ~/.claude.json seed; opt-in plugin baseline installed as the
  member; managed-settings spike script (not run)
- P7: Codex account pool (`agenthub accounts add --tool codex`)
- Roles merged with main's admin / analyst / developer: analysts write
  only their own rows, under S3 as well
- Per-account prefs: one implementation (Chat UI + onboarding)
- Security reviews F1–F49 (five rounds), each fix with a regression
  test: symlink/TOCTOU-safe member reads, no host writes in a member
  home, credentials and the data dir never served, owner and folder
  account must agree, pane tokens bound to the pane's uid, bounded
  sudo/tmux/git calls and member reads (no hang or crash from a member),
  async route rejections answer 500 instead of exiting
- Docs: docs/SERVER-MODE.md (S3 model, accepted ceilings, operator
  runbook), docs/plans/server-mode/S3-PLAN.md, CLAUDE.md S3 rules

Tests: server 2838/2841 (3 need 127.0.0.1:3000, held on this box);
client 1162/1162; tsc clean; headers check passes.

Co-Authored-By: Claude <noreply@anthropic.com>

client/src/pages/AiProxyConfig.tsx

@@ -21,6 +21,11 @@
  * A right-click on a profile row opens its Edit / Remove (plus Copy endpoint)
  * as a menu; the buttons stay.
  *
+ * In server mode a profile is SHARED (an admin's, usable by everyone) or
+ * PERSONAL (the signed-in user's own, badged "Personal"). A member edits only
+ * their own and every profile they add is personal; an admin chooses when
+ * adding; an analyst only reads.
+ *
  * **Test** asks the endpoint itself, once as Claude Code would
  * (`/v1/messages`) and once as Codex would (`/v1/responses`), one line each.
  * "Saved" and "works" are different claims, and the gap between them is only
@@ -43,13 +48,15 @@ import { ContextMenu, MenuItem, MenuSeparator, useContextMenu } from "../compone
 import { confirmDialog } from "../lib/confirm";
 import { copyText } from "../lib/clipboard";
 import { useDialog } from "../hooks/useDialog";
+import { useAuth } from "../components/AuthGate";
 
 const TIERS: (keyof AiProxyModels)[] = ["opus", "sonnet", "haiku", "smallFast", "subagent"];
 
-type FormState = Omit<AiProxyInput, "apiKey" | "models" | "behavesAs"> & {
+type FormState = Omit<AiProxyInput, "apiKey" | "models" | "behavesAs" | "scope"> & {
   apiKey: string;
   behavesAs: string;
   models: Partial<AiProxyModels>;
+  scope: "shared" | "personal";
 };
 
 const emptyForm = (): FormState => ({
@@ -59,10 +66,17 @@ const emptyForm = (): FormState => ({
   model: "",
   models: {},
   behavesAs: "",
+  scope: "shared",
 });
 
 export function AiProxyConfig() {
   const { t } = useTranslation("settings");
+  // Server mode's signed-in user; null in local mode, where the host owns
+  // every (shared) profile.
+  const { state: auth } = useAuth();
+  const user = auth.mode === "server" ? auth.user : null;
+  const isAdmin = !user || user.role === "admin";
+  const canWrite = (item: AiProxy) => !item.builtin && (item.scope === "personal" || isAdmin);
   const [items, setItems] = useState<AiProxy[]>([]);
   const [error, setError] = useState<string | null>(null);
   const [editing, setEditing] = useState<AiProxy | null>(null);
@@ -131,6 +145,7 @@ export function AiProxyConfig() {
       model: item.model,
       models: { ...item.models },
       behavesAs: item.behavesAs ?? "",
+      scope: item.scope ?? "shared",
     });
     setFormError(null);
     setOpen(true);
@@ -187,6 +202,7 @@ export function AiProxyConfig() {
         behavesAs: form.behavesAs.trim(),
       };
       if (form.apiKey.trim()) body.apiKey = form.apiKey.trim();
+      if (user && isAdmin && !editing) body.scope = form.scope;
 
       if (editing) await api.aiProxies.update(editing.name, body);
       else await api.aiProxies.create(body);
@@ -253,13 +269,18 @@ export function AiProxyConfig() {
             {items.map((item) => (
               <tr
                 key={item.name}
-                onContextMenu={item.builtin ? undefined : (e) => ctx.open(e, item)}
+                onContextMenu={canWrite(item) ? (e) => ctx.open(e, item) : undefined}
                 className="border-t border-border"
               >
                 <td className="px-3 py-2">
                   <span className="flex items-center gap-1.5 font-medium text-fg-primary">
                     {item.builtin && <Lock className="h-3 w-3 text-fg-muted" />}
                     {item.label}
+                    {item.scope === "personal" && (
+                      <span className="rounded bg-accent/15 px-1.5 py-px text-[10px] font-normal text-accent">
+                        {t("aiProxy.personal")}
+                      </span>
+                    )}
                   </span>
                   {item.builtin && (
                     <span className="mt-0.5 block text-[10px] text-fg-muted">
@@ -277,7 +298,7 @@ export function AiProxyConfig() {
                   {item.builtin ? "—" : item.hasKey ? t("aiProxy.keySet") : t("aiProxy.keyMissing")}
                 </td>
                 <td className="px-3 py-2 text-right">
-                  {!item.builtin && (
+                  {canWrite(item) && (
                     <span className="inline-flex gap-1">
                       <button
                         type="button"
@@ -349,6 +370,31 @@ export function AiProxyConfig() {
                 value={form.label}
                 onChange={(v) => setForm((f) => ({ ...f, label: v }))}
               />
+              {user && !editing && (
+                <div>
+                  <label className="mb-1 block text-xs text-fg-secondary" htmlFor="proxy-scope">
+                    {t("aiProxy.fieldScope")}
+                  </label>
+                  {isAdmin ? (
+                    <select
+                      id="proxy-scope"
+                      value={form.scope}
+                      onChange={(e) =>
+                        setForm((f) => ({ ...f, scope: e.target.value as FormState["scope"] }))
+                      }
+                      className="w-full rounded-md border border-border-light bg-surface-0 px-3 py-1.5 text-xs text-fg-primary focus:border-accent focus:outline-none"
+                    >
+                      <option value="shared">{t("aiProxy.scopeShared")}</option>
+                      <option value="personal">{t("aiProxy.scopePersonal")}</option>
+                    </select>
+                  ) : (
+                    <p id="proxy-scope" className="text-xs text-fg-primary">
+                      {t("aiProxy.scopePersonal")}
+                    </p>
+                  )}
+                  <p className="mt-1 text-[10px] text-fg-muted">{t("aiProxy.fieldScopeHint")}</p>
+                </div>
+              )}
               <Field
                 id="proxy-base-url"
                 label={t("aiProxy.fieldBaseUrl")}