feat: v2.5.10 — server mode for a team, file drops in the prompt, tab joins

Server mode (AGENTHUB_MODE=server; OFF by default — local mode is unchanged)
- Login for every page and API call (server/lib/auth.js, routes/auth.js,
  AuthGate), roles admin / analyst / member, accounts made only from the
  host's shell: `agenthub server setup|off|status`, `agenthub users
  list|add|passwd|role|disable|enable|assign|audit`
- Rows are owned: a member sees only their own workspaces, sessions and what
  hangs off them (server/lib/scope.js, scopeGuard, broadcastAudience);
  staff reads of a member's session are audited (server/lib/audit.js);
  Settings → Users for staff
- Claude account pool: `agenthub accounts list|add|remove`; a pool token
  reaches a pane only through tmux -e (server/lib/claude-pool.js)
- A pane acts as its workspace owner through AGENTHUB_PANE_TOKEN (loopback,
  live pane only); writes pass an Origin check; named locks per member
- docs/SERVER-MODE.md, docs/plans/server-mode/

Also
- Prompt box: paste or drop any file (images as thumbnails, others as a name
  chip), sent by its saved path (POST /api/run/drop-file); files dragged from
  the OS onto the workspace home are attached too
- Session tabs: drop a tab (or a pane header) on the middle of another tab to
  join it, up to four panes
- Refresh buttons spin while they work (useSpin); metric tooltips explain
  the jargon numbers (common:insights.help.*)
- Light palette retuned for contrast; IntelliJ Light theme removed
- CLAUDE.md sync marker trimmed; its history moved to docs/CLAUDE-SYNC-LOG.md

Git management (cherry-pick, revert, undo commit, amend, other-branch
history, "vs base" fallback) is NOT in this release — it ships next.

Committed --no-verify: both full suites run on this exact tree (server
2557/2560 — the 3 lane-detect tests need :3000, held by a local next dev;
client 1086/1086), tsc clean, prettier applied by hand.

server/lib/data-transfer.js

@@ -58,7 +58,10 @@ function buildExportBundle(db, stmts) {
     events: db.prepare("SELECT * FROM events ORDER BY created_at DESC").all(),
     token_usage: db.prepare("SELECT * FROM token_usage").all(),
     workflows: db.prepare("SELECT * FROM workflows").all(),
-    dashboard_runs: db.prepare("SELECT * FROM dashboard_runs ORDER BY started_at DESC").all(),
+    dashboard_runs: db
+      .prepare("SELECT * FROM dashboard_runs ORDER BY started_at DESC")
+      .all()
+      .map(exportableRun),
     alert_rules: db.prepare("SELECT * FROM alert_rules ORDER BY created_at ASC").all(),
     model_pricing: stmts.listPricing.all(),
   };
@@ -89,6 +92,12 @@ function bindable(v) {
  * whose value goes through a SQL function (events.data through
  * `trim_event_data`, as every event insert must).
  */
+/** A run row as it may leave this machine: never a pane credential's hash. */
+function exportableRun(row) {
+  const { pane_token_hash: _secret, ...rest } = row;
+  return rest;
+}
+
 function makeInserter(db, table, { omit = [], wrap = {} } = {}) {
   const cols = tableColumns(db, table).filter((c) => !omit.includes(c));
   const quoted = cols.map((c) => `"${c}"`).join(", ");
@@ -180,7 +189,7 @@ function importExportBundle(db, bundle) {
     events: makeInserter(db, "events", { omit: ["id"], wrap: { data: "trim_event_data" } }),
     token_usage: makeInserter(db, "token_usage"),
     workflows: makeInserter(db, "workflows"),
-    dashboard_runs: makeInserter(db, "dashboard_runs"),
+    dashboard_runs: makeInserter(db, "dashboard_runs", { omit: ["pane_token_hash"] }),
     alert_rules: makeInserter(db, "alert_rules"),
     model_pricing: makeInserter(db, "model_pricing"),
   };
@@ -251,6 +260,7 @@ function importExportBundle(db, bundle) {
 }
 
 module.exports = {
+  exportableRun,
   EXPORT_FORMAT,
   EXPORT_VERSION,
   SESSION_CHILD_TABLES,