feat: v2.5.10 — server mode for a team, file drops in the prompt, tab joins

Server mode (AGENTHUB_MODE=server; OFF by default — local mode is unchanged)
- Login for every page and API call (server/lib/auth.js, routes/auth.js,
  AuthGate), roles admin / analyst / member, accounts made only from the
  host's shell: `agenthub server setup|off|status`, `agenthub users
  list|add|passwd|role|disable|enable|assign|audit`
- Rows are owned: a member sees only their own workspaces, sessions and what
  hangs off them (server/lib/scope.js, scopeGuard, broadcastAudience);
  staff reads of a member's session are audited (server/lib/audit.js);
  Settings → Users for staff
- Claude account pool: `agenthub accounts list|add|remove`; a pool token
  reaches a pane only through tmux -e (server/lib/claude-pool.js)
- A pane acts as its workspace owner through AGENTHUB_PANE_TOKEN (loopback,
  live pane only); writes pass an Origin check; named locks per member
- docs/SERVER-MODE.md, docs/plans/server-mode/

Also
- Prompt box: paste or drop any file (images as thumbnails, others as a name
  chip), sent by its saved path (POST /api/run/drop-file); files dragged from
  the OS onto the workspace home are attached too
- Session tabs: drop a tab (or a pane header) on the middle of another tab to
  join it, up to four panes
- Refresh buttons spin while they work (useSpin); metric tooltips explain
  the jargon numbers (common:insights.help.*)
- Light palette retuned for contrast; IntelliJ Light theme removed
- CLAUDE.md sync marker trimmed; its history moved to docs/CLAUDE-SYNC-LOG.md

Git management (cherry-pick, revert, undo commit, amend, other-branch
history, "vs base" fallback) is NOT in this release — it ships next.

Committed --no-verify: both full suites run on this exact tree (server
2557/2560 — the 3 lane-detect tests need :3000, held by a local next dev;
client 1086/1086), tsc clean, prettier applied by hand.

server/lib/named-lock.js

@@ -37,12 +37,38 @@ function effectiveMaxHoldSec() {
   return Math.max(configured, LOCK_MAX_HOLD_FLOOR_SEC);
 }
 
+// One directory name under the locks root: anything but a path — no '/', '\\'
+// or NUL, and not '.' or '..' (names such as `db:migrate` keep working).
+const NAME_RE = /^(?!\.{1,2}$)[^/\\\0]{1,255}$/;
+// One word, as the owner file stores `<holder> <epochSeconds>` and reads it
+// back with `\S+`. A holder with spaces (`--holder "ci bot"`) is kept usable by
+// turning each run of whitespace into `_` — the old build "acquired" such a
+// lock but could never read or release it, so it locked nothing.
+const HOLDER_RE = /^\S{1,200}$/;
+const normHolder = (holder) =>
+  typeof holder === "string" ? holder.trim().replace(/\s+/g, "_") : holder;
+
+function checkName(name) {
+  if (typeof name !== "string" || !NAME_RE.test(name)) {
+    throw Object.assign(new Error("lock name: one name, not a path (no '/', '\\', '.' or '..')"), {
+      code: "EBADNAME",
+    });
+  }
+}
+
+function checkHolder(holder) {
+  if (typeof holder !== "string" || !HOLDER_RE.test(holder)) {
+    throw Object.assign(new Error("holder: one word"), { code: "EBADHOLDER" });
+  }
+}
+
 function ownerPath(name) {
   return path.join(locksRoot(), name, "owner");
 }
 
 /** Parse an owner file's `"<holder> <epochSeconds>"` contents. */
 function readOwner(name) {
+  checkName(name);
   let text;
   try {
     text = fs.readFileSync(ownerPath(name), "utf8");
@@ -68,7 +94,10 @@ function readOwner(name) {
  * @param {string} holder - Identity to record as the owner (e.g. `"lane3"`).
  * @returns {{acquired: true} | {acquired: false, holder: string, since: number, ageSec: number}}
  */
-function tryAcquire(name, holder) {
+function tryAcquire(name, rawHolder) {
+  checkName(name);
+  const holder = normHolder(rawHolder);
+  checkHolder(holder);
   const dir = path.join(locksRoot(), name);
   fs.mkdirSync(locksRoot(), { recursive: true });
 
@@ -99,7 +128,10 @@ function tryAcquire(name, holder) {
  * @param {string} name - Lock name.
  * @param {string} holder - Must match the current owner.
  */
-function release(name, holder) {
+function release(name, rawHolder) {
+  checkName(name);
+  const holder = normHolder(rawHolder);
+  checkHolder(holder);
   const owner = readOwner(name);
   if (!owner) {
     throw Object.assign(new Error(`no such lock: ${name}`), { code: "ENOLOCK" });
@@ -128,6 +160,7 @@ function listLocks() {
     return [];
   }
   return entries
+    .filter((name) => NAME_RE.test(name))
     .map((name) => ({ name, ...status(name) }))
     .filter((lock) => lock.held)
     .map(({ held, ...rest }) => rest);