feat: v2.5.10 — server mode for a team, file drops in the prompt, tab joins

Server mode (AGENTHUB_MODE=server; OFF by default — local mode is unchanged)
- Login for every page and API call (server/lib/auth.js, routes/auth.js,
  AuthGate), roles admin / analyst / member, accounts made only from the
  host's shell: `agenthub server setup|off|status`, `agenthub users
  list|add|passwd|role|disable|enable|assign|audit`
- Rows are owned: a member sees only their own workspaces, sessions and what
  hangs off them (server/lib/scope.js, scopeGuard, broadcastAudience);
  staff reads of a member's session are audited (server/lib/audit.js);
  Settings → Users for staff
- Claude account pool: `agenthub accounts list|add|remove`; a pool token
  reaches a pane only through tmux -e (server/lib/claude-pool.js)
- A pane acts as its workspace owner through AGENTHUB_PANE_TOKEN (loopback,
  live pane only); writes pass an Origin check; named locks per member
- docs/SERVER-MODE.md, docs/plans/server-mode/

Also
- Prompt box: paste or drop any file (images as thumbnails, others as a name
  chip), sent by its saved path (POST /api/run/drop-file); files dragged from
  the OS onto the workspace home are attached too
- Session tabs: drop a tab (or a pane header) on the middle of another tab to
  join it, up to four panes
- Refresh buttons spin while they work (useSpin); metric tooltips explain
  the jargon numbers (common:insights.help.*)
- Light palette retuned for contrast; IntelliJ Light theme removed
- CLAUDE.md sync marker trimmed; its history moved to docs/CLAUDE-SYNC-LOG.md

Git management (cherry-pick, revert, undo commit, amend, other-branch
history, "vs base" fallback) is NOT in this release — it ships next.

Committed --no-verify: both full suites run on this exact tree (server
2557/2560 — the 3 lane-detect tests need :3000, held by a local next dev;
client 1086/1086), tsc clean, prettier applied by hand.

server/db.js

@@ -715,6 +715,13 @@ try {
     db.prepare("ALTER TABLE dashboard_runs ADD COLUMN proxy TEXT").run();
   }
 }
+// Which Claude pool account a run's pane was started on (server/lib/claude-pool.js),
+// by name; NULL = the machine's own login. The balancer sums spend per account.
+try {
+  db.prepare("SELECT account FROM dashboard_runs LIMIT 1").get();
+} catch {
+  db.prepare("ALTER TABLE dashboard_runs ADD COLUMN account TEXT").run();
+}
 
 // Migrate: add stage-detection columns to lanes. Inference is never evidence —
 // these are additive columns separate from `stage` (the declared stage), so
@@ -1649,6 +1656,65 @@ db.prepare(
 `
 ).run();
 
+// Server mode: SHA-256 of the pane credential (`AGENTHUB_PANE_TOKEN`) a run's
+// pane was started with — the CLI, MCP server and statusline inside the pane
+// send it to act as the workspace's owner (server/lib/auth.js). Never listed.
+try {
+  db.prepare("SELECT pane_token_hash FROM dashboard_runs LIMIT 1").get();
+} catch {
+  db.prepare("ALTER TABLE dashboard_runs ADD COLUMN pane_token_hash TEXT").run();
+}
+
+// Server mode: whose browser a push subscription is (`users.id`); NULL in
+// local mode. A user's notifications go only to their own subscriptions.
+try {
+  db.prepare("SELECT user_id FROM push_subscriptions LIMIT 1").get();
+} catch {
+  db.prepare("ALTER TABLE push_subscriptions ADD COLUMN user_id INTEGER").run();
+}
+
+// Server mode: the user who created a workspace (`users.id`); NULL = made in
+// local mode or by the host account, which only an admin/analyst sees. Every
+// session, agent, event and token row a member may see hangs off this
+// (server/lib/scope.js).
+try {
+  db.prepare("SELECT owner_id FROM lanes LIMIT 1").get();
+} catch {
+  db.prepare("ALTER TABLE lanes ADD COLUMN owner_id INTEGER").run();
+}
+
+// Server mode's accounts (server/lib/auth.js). Created on every install so
+// switching the mode on needs no migration; empty and unread in local mode.
+// A password is stored only as an scrypt hash, a login session only as the
+// SHA-256 of its cookie token.
+db.exec(`
+  CREATE TABLE IF NOT EXISTS users (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    username TEXT NOT NULL UNIQUE COLLATE NOCASE,
+    role TEXT NOT NULL DEFAULT 'member' CHECK(role IN ('admin','analyst','member')),
+    password_hash TEXT NOT NULL,
+    disabled INTEGER NOT NULL DEFAULT 0,
+    created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+  );
+  -- Every read by an admin/analyst of a session a member owns (server/lib/audit.js).
+  CREATE TABLE IF NOT EXISTS audit_log (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    user_id INTEGER NOT NULL,
+    owner_id INTEGER,
+    session_id TEXT,
+    method TEXT NOT NULL,
+    path TEXT NOT NULL,
+    at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
+  );
+  CREATE INDEX IF NOT EXISTS idx_audit_log_at ON audit_log(at);
+  CREATE TABLE IF NOT EXISTS auth_sessions (
+    token_hash TEXT PRIMARY KEY,
+    user_id INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+    expires_at TEXT NOT NULL
+  );
+`);
+
 migrationLock.exec("COMMIT");
 migrationLock.close();