feat: v2.5.10 — server mode for a team, file drops in the prompt, tab joins

Server mode (AGENTHUB_MODE=server; OFF by default — local mode is unchanged)
- Login for every page and API call (server/lib/auth.js, routes/auth.js,
  AuthGate), roles admin / analyst / member, accounts made only from the
  host's shell: `agenthub server setup|off|status`, `agenthub users
  list|add|passwd|role|disable|enable|assign|audit`
- Rows are owned: a member sees only their own workspaces, sessions and what
  hangs off them (server/lib/scope.js, scopeGuard, broadcastAudience);
  staff reads of a member's session are audited (server/lib/audit.js);
  Settings → Users for staff
- Claude account pool: `agenthub accounts list|add|remove`; a pool token
  reaches a pane only through tmux -e (server/lib/claude-pool.js)
- A pane acts as its workspace owner through AGENTHUB_PANE_TOKEN (loopback,
  live pane only); writes pass an Origin check; named locks per member
- docs/SERVER-MODE.md, docs/plans/server-mode/

Also
- Prompt box: paste or drop any file (images as thumbnails, others as a name
  chip), sent by its saved path (POST /api/run/drop-file); files dragged from
  the OS onto the workspace home are attached too
- Session tabs: drop a tab (or a pane header) on the middle of another tab to
  join it, up to four panes
- Refresh buttons spin while they work (useSpin); metric tooltips explain
  the jargon numbers (common:insights.help.*)
- Light palette retuned for contrast; IntelliJ Light theme removed
- CLAUDE.md sync marker trimmed; its history moved to docs/CLAUDE-SYNC-LOG.md

Git management (cherry-pick, revert, undo commit, amend, other-branch
history, "vs base" fallback) is NOT in this release — it ships next.

Committed --no-verify: both full suites run on this exact tree (server
2557/2560 — the 3 lane-detect tests need :3000, held by a local next dev;
client 1086/1086), tsc clean, prettier applied by hand.

server/index.js

@@ -100,6 +100,12 @@ const laneSourcesRouter = require("./routes/lane-sources");
 const locksRouter = require("./routes/locks");
 const petsRouter = require("./routes/pets");
 const snapshotsRouter = require("./routes/snapshots");
+const authRouter = require("./routes/auth");
+const accountsRouter = require("./routes/accounts");
+const usersRouter = require("./routes/users");
+const { auditGuard } = require("./lib/audit");
+const { authGuard, isServerMode, hasAdmin } = require("./lib/auth");
+const { scopeGuard } = require("./lib/scope");
 
 const APP_VERSION = (() => {
   try {
@@ -119,6 +125,14 @@ function createApp() {
   app.use(hostGuard);
   app.use(express.json({ limit: "1mb" }));
   app.use("/api", tokenGuard);
+  // Server mode's login gate (server/lib/auth.js); a no-op in local mode.
+  app.use("/api", authGuard);
+  // Server mode, phase S2: a member reaches only rows of their own workspaces.
+  app.use("/api", scopeGuard);
+  app.use("/api", auditGuard);
+  app.use("/api/auth", authRouter);
+  app.use("/api/accounts", accountsRouter);
+  app.use("/api/users", usersRouter);
 
   app.use("/api/sessions", sessionsRouter);
   app.use("/api/agents", agentsRouter);
@@ -293,7 +307,12 @@ function startServer(app, port) {
       const mode = isProduction ? "production" : "development";
       const shown = boundLoopback ? "localhost" : host;
       console.log(`Agent Dashboard server running on http://${shown}:${port} (${mode})`);
-      if (!boundLoopback) {
+      if (isServerMode()) {
+        console.log("Server mode: every page and API call needs a login.");
+        if (!hasAdmin()) {
+          console.warn("⚠️  Server mode has no admin yet — run: agenthub server setup");
+        }
+      } else if (!boundLoopback) {
         console.warn(
           `⚠️  Dashboard bound to ${host} — reachable from the network. ` +
             (getDashboardToken()