feat(server-s3): one Linux user per account (S3) — experimental

Server mode can now run each account as its own Linux user (ah-<name>)
when `agenthub server install-system` has set S3 up. The dashboard
reaches a member only through sudo -u / write-as / pane-launch, reads a
member's files only through owner- and type-checked opens, and hooks
are authenticated by peer uid. Local mode and server mode without S3
are unchanged.

EXPERIMENTAL: tested with fake sudo and fake accounts only. It has not
yet been verified on a real install with real member accounts, sudo or
a real Codex login. Do not offer it to real users yet.

- S3 core: provisioning, per-member tmux servers, the proxy key
  gateway, shared tools in /opt, dropped capabilities for children
  (P0–P5)
- P4: plan and quota per member home
- P6: ~/.claude.json seed; opt-in plugin baseline installed as the
  member; managed-settings spike script (not run)
- P7: Codex account pool (`agenthub accounts add --tool codex`)
- Roles merged with main's admin / analyst / developer: analysts write
  only their own rows, under S3 as well
- Per-account prefs: one implementation (Chat UI + onboarding)
- Security reviews F1–F49 (five rounds), each fix with a regression
  test: symlink/TOCTOU-safe member reads, no host writes in a member
  home, credentials and the data dir never served, owner and folder
  account must agree, pane tokens bound to the pane's uid, bounded
  sudo/tmux/git calls and member reads (no hang or crash from a member),
  async route rejections answer 500 instead of exiting
- Docs: docs/SERVER-MODE.md (S3 model, accepted ceilings, operator
  runbook), docs/plans/server-mode/S3-PLAN.md, CLAUDE.md S3 rules

Tests: server 2838/2841 (3 need 127.0.0.1:3000, held on this box);
client 1162/1162; tsc clean; headers check passes.

Co-Authored-By: Claude <noreply@anthropic.com>

server/__tests__/cursor-usage.test.js

@@ -77,6 +77,43 @@ describe("cursor usage", () => {
     assert.equal(cursor.cwdFromSlug(""), null);
   });
 
+  it("bounds the walk: no symlink is followed, and it gives up after a budget", () => {
+    const base = path.join(fs.realpathSync(ROOT), "maze");
+    // A symlink loop: every `a` and `a-a` is the same directory again.
+    const loop = path.join(base, "loop");
+    fs.mkdirSync(loop, { recursive: true });
+    fs.symlinkSync(".", path.join(loop, "a"));
+    fs.symlinkSync(".", path.join(loop, "a-a"));
+    // A real tree with ~1000 directories that all prefix the slug.
+    const tree = path.join(base, "tree");
+    const grow = (dir, t) => {
+      if (t <= 0) return;
+      fs.mkdirSync(path.join(dir, "a"), { recursive: true });
+      grow(path.join(dir, "a"), t - 1);
+      if (t < 2) return;
+      fs.mkdirSync(path.join(dir, "a-a"), { recursive: true });
+      grow(path.join(dir, "a-a"), t - 2);
+    };
+    grow(tree, 13);
+    const real = fs.readdirSync;
+    let calls = 0;
+    fs.readdirSync = (...a) => {
+      if (++calls > 5000) throw new Error("unbounded walk");
+      return real(...a);
+    };
+    try {
+      assert.equal(cursor.cwdFromSlug(`${slugOf(loop)}${"-a".repeat(30)}-z`), null);
+      assert.ok(calls < 20, `followed a symlink loop: ${calls} reads`);
+      calls = 0;
+      assert.equal(cursor.cwdFromSlug(`${slugOf(tree)}${"-a".repeat(13)}-z`), null);
+      assert.ok(calls <= 501, `walked ${calls} directories`);
+      assert.equal(cursor.cwdFromSlug(slugOf(PROJECT)), PROJECT);
+    } finally {
+      fs.readdirSync = real;
+      fs.rmSync(base, { recursive: true, force: true });
+    }
+  });
+
   it("creates the session with its name and cwd, and no tokens", async () => {
     transcript(ID);
     assert.deepEqual(await cursor.ingestCursorUsage(), { files: 1, sessions: 1 });