feat(server-s3): one Linux user per account (S3) — experimental

Server mode can now run each account as its own Linux user (ah-<name>)
when `agenthub server install-system` has set S3 up. The dashboard
reaches a member only through sudo -u / write-as / pane-launch, reads a
member's files only through owner- and type-checked opens, and hooks
are authenticated by peer uid. Local mode and server mode without S3
are unchanged.

EXPERIMENTAL: tested with fake sudo and fake accounts only. It has not
yet been verified on a real install with real member accounts, sudo or
a real Codex login. Do not offer it to real users yet.

- S3 core: provisioning, per-member tmux servers, the proxy key
  gateway, shared tools in /opt, dropped capabilities for children
  (P0–P5)
- P4: plan and quota per member home
- P6: ~/.claude.json seed; opt-in plugin baseline installed as the
  member; managed-settings spike script (not run)
- P7: Codex account pool (`agenthub accounts add --tool codex`)
- Roles merged with main's admin / analyst / developer: analysts write
  only their own rows, under S3 as well
- Per-account prefs: one implementation (Chat UI + onboarding)
- Security reviews F1–F49 (five rounds), each fix with a regression
  test: symlink/TOCTOU-safe member reads, no host writes in a member
  home, credentials and the data dir never served, owner and folder
  account must agree, pane tokens bound to the pane's uid, bounded
  sudo/tmux/git calls and member reads (no hang or crash from a member),
  async route rejections answer 500 instead of exiting
- Docs: docs/SERVER-MODE.md (S3 model, accepted ceilings, operator
  runbook), docs/plans/server-mode/S3-PLAN.md, CLAUDE.md S3 rules

Tests: server 2838/2841 (3 need 127.0.0.1:3000, held on this box);
client 1162/1162; tsc clean; headers check passes.

Co-Authored-By: Claude <noreply@anthropic.com>

client/src/pages/__tests__/AiProxyConfig.test.tsx

@@ -2,7 +2,8 @@
  * @file Tests for the AI Proxy settings page — listing profiles, creating one,
  * and the two rules that keep a key safe: the form never shows one, and an
  * edit that leaves the field blank must not send an empty key that would wipe
- * the stored one.
+ * the stored one. In server mode: a developer or analyst edits only their
+ * personal profiles and adds personal ones, an admin picks shared or personal.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
@@ -12,6 +13,12 @@ import userEvent from "@testing-library/user-event";
 import { AiProxyConfig } from "../AiProxyConfig";
 import { api } from "../../lib/api";
 import { settleConfirm, subscribeConfirm, type PendingConfirm } from "../../lib/confirm";
+import type { AuthState } from "../../lib/api";
+
+let authState: AuthState = { mode: "local" };
+vi.mock("../../components/AuthGate", () => ({
+  useAuth: () => ({ state: authState, logout: async () => {} }),
+}));
 
 vi.mock("../../lib/api", () => ({
   api: {
@@ -60,6 +67,7 @@ const nineRouter = {
 };
 
 beforeEach(() => {
+  authState = { mode: "local" };
   vi.mocked(api.aiProxies.list)
     .mockReset()
     .mockResolvedValue({ items: [native] });
@@ -286,3 +294,70 @@ describe("AiProxyConfig — testing an endpoint before saving it", () => {
     off();
   });
 });
+
+describe("AiProxyConfig in server mode", () => {
+  const shared = { ...nineRouter, scope: "shared" as const };
+  const mine = {
+    ...nineRouter,
+    name: "u7_mine",
+    label: "Mine",
+    scope: "personal" as const,
+  };
+  const signIn = (role: "admin" | "developer" | "analyst") => {
+    authState = { mode: "server", user: { id: 7, username: "mia", role } };
+  };
+
+  it("lets a developer edit only their personal profile, badged Personal", async () => {
+    signIn("developer");
+    vi.mocked(api.aiProxies.list).mockResolvedValue({ items: [native, shared, mine] });
+    render(<AiProxyConfig />);
+    await screen.findByText("Mine");
+    expect(screen.getByText("aiProxy.personal")).toBeInTheDocument();
+    expect(screen.queryByRole("button", { name: /aiProxy\.edit 9Router/ })).toBeNull();
+    expect(screen.getByRole("button", { name: /aiProxy\.edit Mine/ })).toBeInTheDocument();
+  });
+
+  it("adds a developer's profile as personal, with no scope choice", async () => {
+    signIn("developer");
+    const user = userEvent.setup();
+    render(<AiProxyConfig />);
+    await user.click(await screen.findByRole("button", { name: /aiProxy\.add/ }));
+    const dialog = screen.getByRole("dialog");
+    expect(within(dialog).queryByRole("combobox")).toBeNull();
+    expect(within(dialog).getByText("aiProxy.scopePersonal")).toBeInTheDocument();
+    await user.type(screen.getByLabelText("aiProxy.fieldLabel"), "Mine");
+    await user.type(screen.getByLabelText("aiProxy.fieldBaseUrl"), "http://x:1");
+    await user.type(screen.getByLabelText("aiProxy.fieldModel"), "m");
+    await user.click(screen.getByRole("button", { name: "aiProxy.save" }));
+    await waitFor(() => expect(api.aiProxies.create).toHaveBeenCalled());
+    expect(vi.mocked(api.aiProxies.create).mock.calls[0]?.[0].scope).toBeUndefined();
+  });
+
+  it("lets an admin choose a personal profile", async () => {
+    signIn("admin");
+    vi.mocked(api.aiProxies.list).mockResolvedValue({ items: [native, shared] });
+    const user = userEvent.setup();
+    render(<AiProxyConfig />);
+    expect(
+      await screen.findByRole("button", { name: /aiProxy\.edit 9Router/ })
+    ).toBeInTheDocument();
+    await user.click(screen.getByRole("button", { name: /aiProxy\.add/ }));
+    await user.selectOptions(screen.getByLabelText("aiProxy.fieldScope"), "personal");
+    await user.type(screen.getByLabelText("aiProxy.fieldLabel"), "Boss");
+    await user.type(screen.getByLabelText("aiProxy.fieldBaseUrl"), "http://x:1");
+    await user.type(screen.getByLabelText("aiProxy.fieldModel"), "m");
+    await user.click(screen.getByRole("button", { name: "aiProxy.save" }));
+    await waitFor(() => expect(api.aiProxies.create).toHaveBeenCalled());
+    expect(vi.mocked(api.aiProxies.create).mock.calls[0]?.[0].scope).toBe("personal");
+  });
+
+  it("gives an analyst Add and Edit on personal profiles only", async () => {
+    signIn("analyst");
+    vi.mocked(api.aiProxies.list).mockResolvedValue({ items: [native, shared, mine] });
+    render(<AiProxyConfig />);
+    await screen.findByText("Mine");
+    expect(screen.getByRole("button", { name: /aiProxy\.add/ })).toBeInTheDocument();
+    expect(screen.queryByRole("button", { name: /aiProxy\.edit 9Router/ })).toBeNull();
+    expect(screen.getByRole("button", { name: /aiProxy\.edit Mine/ })).toBeInTheDocument();
+  });
+});