feat(server-s3): one Linux user per account (S3) — experimental

Server mode can now run each account as its own Linux user (ah-<name>)
when `agenthub server install-system` has set S3 up. The dashboard
reaches a member only through sudo -u / write-as / pane-launch, reads a
member's files only through owner- and type-checked opens, and hooks
are authenticated by peer uid. Local mode and server mode without S3
are unchanged.

EXPERIMENTAL: tested with fake sudo and fake accounts only. It has not
yet been verified on a real install with real member accounts, sudo or
a real Codex login. Do not offer it to real users yet.

- S3 core: provisioning, per-member tmux servers, the proxy key
  gateway, shared tools in /opt, dropped capabilities for children
  (P0–P5)
- P4: plan and quota per member home
- P6: ~/.claude.json seed; opt-in plugin baseline installed as the
  member; managed-settings spike script (not run)
- P7: Codex account pool (`agenthub accounts add --tool codex`)
- Roles merged with main's admin / analyst / developer: analysts write
  only their own rows, under S3 as well
- Per-account prefs: one implementation (Chat UI + onboarding)
- Security reviews F1–F49 (five rounds), each fix with a regression
  test: symlink/TOCTOU-safe member reads, no host writes in a member
  home, credentials and the data dir never served, owner and folder
  account must agree, pane tokens bound to the pane's uid, bounded
  sudo/tmux/git calls and member reads (no hang or crash from a member),
  async route rejections answer 500 instead of exiting
- Docs: docs/SERVER-MODE.md (S3 model, accepted ceilings, operator
  runbook), docs/plans/server-mode/S3-PLAN.md, CLAUDE.md S3 rules

Tests: server 2838/2841 (3 need 127.0.0.1:3000, held on this box);
client 1162/1162; tsc clean; headers check passes.

Co-Authored-By: Claude <noreply@anthropic.com>

server/routes/pricing.js

@@ -620,8 +620,22 @@ router.get("/cost", (req, res) => {
 
 // GET /api/pricing/quota - plan quota spent per AI tool (server/lib/quota.js lists them):
 // percentages and reset times only, `?force=1` for a Refresh click (server/lib/quota.js).
+// Server mode with S3: a non-admin gets their own Linux account's quota only.
 router.get("/quota", async (req, res) => {
-  const out = await quotas({ force: req.query.force === "1" });
+  const force = req.query.force === "1";
+  // S3: a developer's or analyst's plan is their OWN Linux account's, read
+  // from its home — never the host's; no provisioned account, no rows.
+  if (req.user && req.user.role !== "admin" && require("../lib/linux-accounts").s3Enabled()) {
+    let acct = null;
+    try {
+      acct = require("../lib/run-as").accountForUser(req.user.username);
+    } catch {
+      /* EMEMBERGONE: nothing of theirs to read */
+    }
+    if (!acct) return res.json({ tools: [], checkedAt: new Date().toISOString() });
+    return res.json(await quotas({ force, home: acct.home }));
+  }
+  const out = await quotas({ force });
   // Server mode: a member sees how full the plan is, not whose accounts.
   if (require("../lib/scope").memberId(req) != null && Array.isArray(out.tools)) {
     out.tools = out.tools.map((t) => ({ ...t, account: null, label: t.id }));