chore: maintenance — dependency majors, rename step 4, member Claude config, OpenAPI coverage

Dependencies
- Security: body-parser and multer DoS advisories fixed (npm audit: 0).
- Server: Express 5 (query parser kept "extended", req.body defaults to {},
  SPA catch-all /{*splat}, send-file helper restores Express 4's dot-folder
  rule for sendFile/download, alerts ack route without inline regex),
  better-sqlite3 13, js-yaml 5 (server/lib/yaml.js keeps js-yaml 4's default
  schema), uuid dropped for crypto.randomUUID, node-pty beta.18, multer 2.5.
- Client: React 19, xterm 6 (WebGL renderer replaces the removed canvas one,
  DOM fallback on context loss; Alt+arrow word moves re-mapped), lucide-react 1,
  TypeScript 7, i18next/react-i18next/codemirror minors.

Workspace rename step 4
- `agenthub lanes` and `--lane` exit 1 with "renamed: use …"; client api.ts,
  the CLI and the MCP server call /api/workspaces; /api/lanes stays mounted.

Server mode (S3): members manage their own Claude Code config
- server/lib/cc-target.js resolves whose config a /cc-config request touches
  and gates the router by allowlist; /profiles* and /plugins/update-all stay
  admin-only. Member writes go through write-as, CLI calls through sudo as the
  member (never -y), reads through openSafe; cc_config_changed reaches only
  its owner. Not verified live on an S3 install yet.

Other
- Chat: an HTML file is an artifact only when written whole and not a project
  page (index.html, or under src/, public/, templates/, …).
- OpenAPI covers every /api route; openapi-coverage.test.js guards it.
- read-pool test keeps its event loop alive (its worker is unref'd).
- Docs: plan statuses, checklists, CLI.md, LANES.md, SERVER-MODE.md, API.md.

server/__tests__/read-pool.test.js

@@ -20,7 +20,14 @@ process.env.DASHBOARD_DB_PATH = TEST_DB;
 const { db } = require("../db");
 const { runRead } = require("../lib/read-pool");
 
+// The pool unrefs its worker (a server must be able to exit while one idles),
+// so nothing else would keep this file's event loop alive while a job runs:
+// node:test then cancels the awaiting test ("Promise resolution is still
+// pending but the event loop has already resolved"). A server never sees this.
+let keepAlive;
+
 before(() => {
+  keepAlive = setInterval(() => {}, 1000);
   db.prepare("INSERT INTO sessions (id, status) VALUES ('rp-1', 'completed')").run();
   const ins = db.prepare(
     "INSERT INTO events (session_id, event_type, tool_name) VALUES ('rp-1', 'PreToolUse', ?)"
@@ -34,6 +41,7 @@ afterEach(() => {
 });
 
 after(() => {
+  clearInterval(keepAlive);
   try {
     db.close();
   } catch {}