feat(server-s3): one Linux user per account (S3) — experimental

Server mode can now run each account as its own Linux user (ah-<name>)
when `agenthub server install-system` has set S3 up. The dashboard
reaches a member only through sudo -u / write-as / pane-launch, reads a
member's files only through owner- and type-checked opens, and hooks
are authenticated by peer uid. Local mode and server mode without S3
are unchanged.

EXPERIMENTAL: tested with fake sudo and fake accounts only. It has not
yet been verified on a real install with real member accounts, sudo or
a real Codex login. Do not offer it to real users yet.

- S3 core: provisioning, per-member tmux servers, the proxy key
  gateway, shared tools in /opt, dropped capabilities for children
  (P0–P5)
- P4: plan and quota per member home
- P6: ~/.claude.json seed; opt-in plugin baseline installed as the
  member; managed-settings spike script (not run)
- P7: Codex account pool (`agenthub accounts add --tool codex`)
- Roles merged with main's admin / analyst / developer: analysts write
  only their own rows, under S3 as well
- Per-account prefs: one implementation (Chat UI + onboarding)
- Security reviews F1–F49 (five rounds), each fix with a regression
  test: symlink/TOCTOU-safe member reads, no host writes in a member
  home, credentials and the data dir never served, owner and folder
  account must agree, pane tokens bound to the pane's uid, bounded
  sudo/tmux/git calls and member reads (no hang or crash from a member),
  async route rejections answer 500 instead of exiting
- Docs: docs/SERVER-MODE.md (S3 model, accepted ceilings, operator
  runbook), docs/plans/server-mode/S3-PLAN.md, CLAUDE.md S3 rules

Tests: server 2838/2841 (3 need 127.0.0.1:3000, held on this box);
client 1162/1162; tsc clean; headers check passes.

Co-Authored-By: Claude <noreply@anthropic.com>

server/lib/worktree.js

@@ -40,6 +40,8 @@ async function git(
     env: extraEnv = {},
     // "buffer" for a binary read (an image at a revision).
     encoding = "utf8",
+    // stdin (a patch for `apply -`): never a file the dashboard writes.
+    input = null,
   } = {}
 ) {
   // Build a clean environment: copy process.env but scrub git hook variables
@@ -74,8 +76,31 @@ async function git(
   // Caller-supplied last: the git credential helper's inputs (git-credentials.js).
   Object.assign(env, extraEnv);
 
+  // S3: in a member's folder git runs AS the member — the dashboard cannot
+  // write there, and git refuses a repository another uid owns. Only these
+  // variables cross sudo, and never a secret: sudo logs its command line
+  // (git-credentials.js gives a member's folder no helper of ours).
+  const member = require("./run-as").accountForPath(cwd);
+  let cmd = "git";
+  let argv = args;
+  if (member) {
+    const pass = { GIT_TERMINAL_PROMPT: "0", HOME: member.home, ...extraEnv };
+    if (literal) pass.GIT_LITERAL_PATHSPECS = "1";
+    [cmd, argv] = require("./run-as").sudoArgv(member, "git", args, pass);
+  }
+
   try {
-    const result = await execFileAsync("git", args, {
+    const run =
+      input == null
+        ? execFileAsync
+        : (c, a, o) =>
+            new Promise((resolve, reject) => {
+              const child = execFile(c, a, o, (err, stdout, stderr) =>
+                err ? reject(Object.assign(err, { stdout, stderr })) : resolve({ stdout, stderr })
+              );
+              child.stdin.end(input);
+            });
+    const result = await run(cmd, argv, {
       cwd,
       env,
       // A read with its own size cap passes a bigger buffer and treats an