feat(server-s3): one Linux user per account (S3) — experimental

Server mode can now run each account as its own Linux user (ah-<name>)
when `agenthub server install-system` has set S3 up. The dashboard
reaches a member only through sudo -u / write-as / pane-launch, reads a
member's files only through owner- and type-checked opens, and hooks
are authenticated by peer uid. Local mode and server mode without S3
are unchanged.

EXPERIMENTAL: tested with fake sudo and fake accounts only. It has not
yet been verified on a real install with real member accounts, sudo or
a real Codex login. Do not offer it to real users yet.

- S3 core: provisioning, per-member tmux servers, the proxy key
  gateway, shared tools in /opt, dropped capabilities for children
  (P0–P5)
- P4: plan and quota per member home
- P6: ~/.claude.json seed; opt-in plugin baseline installed as the
  member; managed-settings spike script (not run)
- P7: Codex account pool (`agenthub accounts add --tool codex`)
- Roles merged with main's admin / analyst / developer: analysts write
  only their own rows, under S3 as well
- Per-account prefs: one implementation (Chat UI + onboarding)
- Security reviews F1–F49 (five rounds), each fix with a regression
  test: symlink/TOCTOU-safe member reads, no host writes in a member
  home, credentials and the data dir never served, owner and folder
  account must agree, pane tokens bound to the pane's uid, bounded
  sudo/tmux/git calls and member reads (no hang or crash from a member),
  async route rejections answer 500 instead of exiting
- Docs: docs/SERVER-MODE.md (S3 model, accepted ceilings, operator
  runbook), docs/plans/server-mode/S3-PLAN.md, CLAUDE.md S3 rules

Tests: server 2838/2841 (3 need 127.0.0.1:3000, held on this box);
client 1162/1162; tsc clean; headers check passes.

Co-Authored-By: Claude <noreply@anthropic.com>

server/openapi-extra/lanes.js

@@ -492,6 +492,10 @@ const paths = {
             "{branches: string[], current: string | null, worktrees: {path, branch?, locked?}[]}. The worktrees ride along so the picker can grey out branches git would refuse to check out twice.",
         },
         400: { description: "repo is missing, relative, does not exist, or is not a git repo." },
+        403: {
+          description:
+            "EFOLDER — server mode with AGENTHUB_USERS_ROOT: a developer named a repo outside their own folder.",
+        },
       },
     },
   },
@@ -589,7 +593,7 @@ const paths = {
         },
         403: {
           description:
-            "ESECRET — `.claude/settings.local.json` (where an older build kept the AI Proxy key) is refused at every rev, at any depth, and under any path that resolves to it (a symlinked `.claude`).",
+            "ESECRET — `.claude/settings.local.json` (where an older build kept the AI Proxy key) is refused at every rev, at any depth, and under any path that resolves to it (a symlinked `.claude`); under S3 also a dot folder at the top of a member's home. EFOREIGN — under S3 the workspace folder now resolves into another account's files.",
         },
         404: { description: "Lane not found." },
       },
@@ -612,7 +616,10 @@ const paths = {
             "{available, path, commits: {<sha>: {short, author, date, summary}}, lines: [<sha>|null]}.",
         },
         400: { description: "EBADPATH, ENOFILE or ETOOBIG." },
-        403: { description: "ESECRET." },
+        403: {
+          description:
+            "ESECRET, or EFOREIGN (S3: the workspace folder resolves into another account's files).",
+        },
         404: { description: "Lane not found." },
       },
     },
@@ -632,7 +639,10 @@ const paths = {
       responses: {
         200: { description: "The image bytes, typed by extension." },
         400: { description: "EBADPATH, EBADREV, ENOFILE, ENOTIMAGE or ETOOBIG." },
-        403: { description: "ESECRET." },
+        403: {
+          description:
+            "ESECRET, or EFOREIGN (S3: the workspace folder resolves into another account's files).",
+        },
         404: { description: "Lane not found." },
       },
     },