feat(server-s3): one Linux user per account (S3) — experimental

Server mode can now run each account as its own Linux user (ah-<name>)
when `agenthub server install-system` has set S3 up. The dashboard
reaches a member only through sudo -u / write-as / pane-launch, reads a
member's files only through owner- and type-checked opens, and hooks
are authenticated by peer uid. Local mode and server mode without S3
are unchanged.

EXPERIMENTAL: tested with fake sudo and fake accounts only. It has not
yet been verified on a real install with real member accounts, sudo or
a real Codex login. Do not offer it to real users yet.

- S3 core: provisioning, per-member tmux servers, the proxy key
  gateway, shared tools in /opt, dropped capabilities for children
  (P0–P5)
- P4: plan and quota per member home
- P6: ~/.claude.json seed; opt-in plugin baseline installed as the
  member; managed-settings spike script (not run)
- P7: Codex account pool (`agenthub accounts add --tool codex`)
- Roles merged with main's admin / analyst / developer: analysts write
  only their own rows, under S3 as well
- Per-account prefs: one implementation (Chat UI + onboarding)
- Security reviews F1–F49 (five rounds), each fix with a regression
  test: symlink/TOCTOU-safe member reads, no host writes in a member
  home, credentials and the data dir never served, owner and folder
  account must agree, pane tokens bound to the pane's uid, bounded
  sudo/tmux/git calls and member reads (no hang or crash from a member),
  async route rejections answer 500 instead of exiting
- Docs: docs/SERVER-MODE.md (S3 model, accepted ceilings, operator
  runbook), docs/plans/server-mode/S3-PLAN.md, CLAUDE.md S3 rules

Tests: server 2838/2841 (3 need 127.0.0.1:3000, held on this box);
client 1162/1162; tsc clean; headers check passes.

Co-Authored-By: Claude <noreply@anthropic.com>

server/__tests__/run.test.js

@@ -14,6 +14,7 @@ const http = require("node:http");
 
 const TMP = fs.mkdtempSync(path.join(os.tmpdir(), "run-route-test-"));
 process.env.DASHBOARD_DB_PATH = path.join(TMP, "dashboard.db");
+process.env.DASHBOARD_DATA_DIR = path.join(TMP, "data");
 
 const { createApp } = require("../index");
 const tmux = require("../lib/tmux");
@@ -226,7 +227,9 @@ describe("POST /api/run/drop-image", () => {
     });
     assert.equal(r.status, 200);
     assert.match(path.basename(r.body.path), /^[0-9a-f]{16}\.png$/);
-    assert.ok(r.body.path.startsWith(os.tmpdir()));
+    // The host's own data dir, never a predictable name in the shared tmp.
+    assert.equal(path.dirname(r.body.path), path.join(TMP, "data", "drops"));
+    assert.equal(fs.statSync(path.dirname(r.body.path)).mode & 0o777, 0o700);
     assert.deepEqual(fs.readFileSync(r.body.path), PNG);
     assert.equal(fs.statSync(r.body.path).mode & 0o777, 0o600);
     fs.unlinkSync(r.body.path);
@@ -256,10 +259,7 @@ describe("POST /api/run/drop-image", () => {
       raw: { type: "application/pdf", buf: Buffer.from("%PDF") },
     });
     assert.equal(r.status, 200);
-    assert.equal(
-      path.dirname(r.body.path),
-      path.join(os.tmpdir(), `agenthub-drops-${os.userInfo().uid}`)
-    );
+    assert.equal(path.dirname(r.body.path), path.join(TMP, "data", "drops"));
     assert.match(path.basename(r.body.path), /^[0-9a-f]{16}-b_o_c_o_Q3\.pdf$/);
     assert.equal(fs.readFileSync(r.body.path, "utf8"), "%PDF");
     assert.equal(fs.statSync(r.body.path).mode & 0o777, 0o600);