chore: maintenance — dependency majors, rename step 4, member Claude config, OpenAPI coverage

Dependencies
- Security: body-parser and multer DoS advisories fixed (npm audit: 0).
- Server: Express 5 (query parser kept "extended", req.body defaults to {},
  SPA catch-all /{*splat}, send-file helper restores Express 4's dot-folder
  rule for sendFile/download, alerts ack route without inline regex),
  better-sqlite3 13, js-yaml 5 (server/lib/yaml.js keeps js-yaml 4's default
  schema), uuid dropped for crypto.randomUUID, node-pty beta.18, multer 2.5.
- Client: React 19, xterm 6 (WebGL renderer replaces the removed canvas one,
  DOM fallback on context loss; Alt+arrow word moves re-mapped), lucide-react 1,
  TypeScript 7, i18next/react-i18next/codemirror minors.

Workspace rename step 4
- `agenthub lanes` and `--lane` exit 1 with "renamed: use …"; client api.ts,
  the CLI and the MCP server call /api/workspaces; /api/lanes stays mounted.

Server mode (S3): members manage their own Claude Code config
- server/lib/cc-target.js resolves whose config a /cc-config request touches
  and gates the router by allowlist; /profiles* and /plugins/update-all stay
  admin-only. Member writes go through write-as, CLI calls through sudo as the
  member (never -y), reads through openSafe; cc_config_changed reaches only
  its owner. Not verified live on an S3 install yet.

Other
- Chat: an HTML file is an artifact only when written whole and not a project
  page (index.html, or under src/, public/, templates/, …).
- OpenAPI covers every /api route; openapi-coverage.test.js guards it.
- read-pool test keeps its event loop alive (its worker is unref'd).
- Docs: plan statuses, checklists, CLI.md, LANES.md, SERVER-MODE.md, API.md.

server/openapi-extra/auth.js

@@ -599,6 +599,20 @@ const paths = {
         409: err("ESELF / ENOTOWNED / EOWNERFOLDER"),
       },
     },
+    delete: {
+      tags: ["Auth"],
+      operationId: "deleteServerUser",
+      summary:
+        "Admin (Delete user): the account for good — its logins, panes, workspaces' records and prefs, and under S3 its Linux account and whole home, removed FIRST so a refusal leaves every row. Session history and the audit log stay. Never yourself (ESELF) or the last enabled admin (ELASTADMIN)",
+      parameters: [idParam],
+      requestBody: changeBody({}),
+      responses: {
+        ...changeResponses,
+        200: { description: "Deleted — the account as it was", content: userBody },
+        409: err("ESELF — yourself / ELASTADMIN — the last enabled admin"),
+        502: err("EPROVISION — the Linux account or home could not be removed; nothing deleted"),
+      },
+    },
   },
   "/api/users/{id}/password": {
     post: {

server/openapi-extra/cc-config.js

@@ -5,7 +5,8 @@
  * servers, hooks, settings, memory, marketplaces, keybindings, statusline,
  * hook scripts, single-file body) plus the low-risk mutation surface
  * (PUT/DELETE /file), the backups listing, and the auth-profile surface
- * (`/profiles*` — swap which Anthropic account the local CLI runs as).
+ * (`/profiles*` — swap which Anthropic account the local CLI runs as), and
+ * `/target` — whose config a server-mode login manages (a member's own, S3).
  *
  * Exports `{ tags, schemas, paths }` for deep-merge by
  * `server/openapi-extra.js`. All schema names are prefixed with `CcConfig`
@@ -1343,6 +1344,34 @@ const cwdParam = {
 // ── Paths ───────────────────────────────────────────────────────────────
 
 const paths = {
+  "/api/cc-config/target": {
+    get: {
+      tags: ["CcConfig"],
+      summary: "Whose Claude Code config this login manages",
+      description:
+        "Server mode: `own` for a non-admin with their own Linux account (S3) — every other endpoint then reads and writes THEIR `~/.claude`, writes running as them; `host` for an admin (and in local mode), or an analyst's read-only view of the host's; `none` for a non-admin with no account (the other endpoints answer 403 ENOACCOUNT). Never an error.",
+      operationId: "ccConfigGetTarget",
+      responses: {
+        200: {
+          description: "The target.",
+          content: {
+            "application/json": {
+              schema: {
+                type: "object",
+                properties: {
+                  kind: { type: "string", enum: ["own", "host", "none"] },
+                  readOnly: { type: "boolean" },
+                  claudeHome: { type: "string", nullable: true },
+                },
+              },
+              example: { kind: "own", readOnly: false, claudeHome: "/srv/agenthub/mia/.claude" },
+            },
+          },
+        },
+      },
+    },
+  },
+
   "/api/cc-config/overview": {
     get: {
       tags: ["CcConfig"],

server/openapi-extra/files.js

@@ -419,12 +419,20 @@ const paths = {
       },
     },
   },
-  "/api/me/git/ssh-user/{from}": {
+  "/api/me/git/ssh-user/{host}": {
     delete: {
       tags: ["Git identity"],
       summary: "Drop the SSH login of a host or alias (and its key link)",
       operationId: "deleteSshUser",
-      parameters: [{ name: "from", in: "path", required: true, schema: { type: "string" } }],
+      parameters: [
+        {
+          name: "host",
+          in: "path",
+          required: true,
+          description: "The host or alias the login was saved under.",
+          schema: { type: "string" },
+        },
+      ],
       responses: { 200: { description: "The identity." }, 404: { description: "ENOTFOUND" } },
     },
   },