feat: v2.5.10 — server mode for a team, file drops in the prompt, tab joins

Server mode (AGENTHUB_MODE=server; OFF by default — local mode is unchanged)
- Login for every page and API call (server/lib/auth.js, routes/auth.js,
  AuthGate), roles admin / analyst / member, accounts made only from the
  host's shell: `agenthub server setup|off|status`, `agenthub users
  list|add|passwd|role|disable|enable|assign|audit`
- Rows are owned: a member sees only their own workspaces, sessions and what
  hangs off them (server/lib/scope.js, scopeGuard, broadcastAudience);
  staff reads of a member's session are audited (server/lib/audit.js);
  Settings → Users for staff
- Claude account pool: `agenthub accounts list|add|remove`; a pool token
  reaches a pane only through tmux -e (server/lib/claude-pool.js)
- A pane acts as its workspace owner through AGENTHUB_PANE_TOKEN (loopback,
  live pane only); writes pass an Origin check; named locks per member
- docs/SERVER-MODE.md, docs/plans/server-mode/

Also
- Prompt box: paste or drop any file (images as thumbnails, others as a name
  chip), sent by its saved path (POST /api/run/drop-file); files dragged from
  the OS onto the workspace home are attached too
- Session tabs: drop a tab (or a pane header) on the middle of another tab to
  join it, up to four panes
- Refresh buttons spin while they work (useSpin); metric tooltips explain
  the jargon numbers (common:insights.help.*)
- Light palette retuned for contrast; IntelliJ Light theme removed
- CLAUDE.md sync marker trimmed; its history moved to docs/CLAUDE-SYNC-LOG.md

Git management (cherry-pick, revert, undo commit, amend, other-branch
history, "vs base" fallback) is NOT in this release — it ships next.

Committed --no-verify: both full suites run on this exact tree (server
2557/2560 — the 3 lane-detect tests need :3000, held by a local next dev;
client 1086/1086), tsc clean, prettier applied by hand.

client/src/pages/Workflows.tsx

@@ -78,6 +78,7 @@ import { api } from "../lib/api";
 import type { DateRange } from "../lib/dateRange";
 import { eventBus } from "../lib/eventBus";
 import { useLiveRefresh } from "../hooks/useLiveRefresh";
+import { useSpin } from "../hooks/useSpin";
 import type { WorkflowData, WSMessage } from "../lib/types";
 
 import { WorkflowStats } from "../components/workflows/WorkflowStats";
@@ -150,10 +151,7 @@ export function Workflows({
       msg.type === "workflow_upserted",
   });
 
-  const handleRefresh = () => {
-    setLoading(true);
-    fetchData();
-  };
+  const [refreshing, handleRefresh] = useSpin(fetchData);
 
   const handleExport = () => {
     if (!data) return;
@@ -174,6 +172,7 @@ export function Workflows({
           statusFilter={statusFilter}
           onStatusFilterChange={setStatusFilter}
           onRefresh={handleRefresh}
+          refreshing={refreshing}
           onExport={handleExport}
           lastUpdated={null}
         />
@@ -197,6 +196,7 @@ export function Workflows({
           statusFilter={statusFilter}
           onStatusFilterChange={setStatusFilter}
           onRefresh={handleRefresh}
+          refreshing={refreshing}
           onExport={handleExport}
           lastUpdated={null}
         />
@@ -221,6 +221,7 @@ export function Workflows({
         statusFilter={statusFilter}
         onStatusFilterChange={setStatusFilter}
         onRefresh={handleRefresh}
+        refreshing={refreshing}
         onExport={handleExport}
         lastUpdated={lastUpdated}
       />
@@ -499,6 +500,7 @@ function PageHeader({
   statusFilter,
   onStatusFilterChange,
   onRefresh,
+  refreshing = false,
   onExport,
   lastUpdated,
 }: {
@@ -507,6 +509,7 @@ function PageHeader({
   statusFilter: StatusFilter;
   onStatusFilterChange: (f: StatusFilter) => void;
   onRefresh: () => void;
+  refreshing?: boolean;
   onExport: () => void;
   lastUpdated: Date | null;
 }) {
@@ -566,10 +569,12 @@ function PageHeader({
         {/* Actions */}
         <button
           onClick={onRefresh}
+          disabled={refreshing}
+          aria-busy={refreshing}
           className="p-2 rounded-lg text-fg-muted hover:text-fg-secondary hover:bg-surface-3 transition-colors"
           title={t("refreshData")}
         >
-          <RefreshCw className="w-4 h-4" />
+          <RefreshCw className={`w-4 h-4 ${refreshing ? "animate-spin" : ""}`} />
         </button>
         <button
           onClick={onExport}