feat: v2.5.10 — server mode for a team, file drops in the prompt, tab joins

Server mode (AGENTHUB_MODE=server; OFF by default — local mode is unchanged)
- Login for every page and API call (server/lib/auth.js, routes/auth.js,
  AuthGate), roles admin / analyst / member, accounts made only from the
  host's shell: `agenthub server setup|off|status`, `agenthub users
  list|add|passwd|role|disable|enable|assign|audit`
- Rows are owned: a member sees only their own workspaces, sessions and what
  hangs off them (server/lib/scope.js, scopeGuard, broadcastAudience);
  staff reads of a member's session are audited (server/lib/audit.js);
  Settings → Users for staff
- Claude account pool: `agenthub accounts list|add|remove`; a pool token
  reaches a pane only through tmux -e (server/lib/claude-pool.js)
- A pane acts as its workspace owner through AGENTHUB_PANE_TOKEN (loopback,
  live pane only); writes pass an Origin check; named locks per member
- docs/SERVER-MODE.md, docs/plans/server-mode/

Also
- Prompt box: paste or drop any file (images as thumbnails, others as a name
  chip), sent by its saved path (POST /api/run/drop-file); files dragged from
  the OS onto the workspace home are attached too
- Session tabs: drop a tab (or a pane header) on the middle of another tab to
  join it, up to four panes
- Refresh buttons spin while they work (useSpin); metric tooltips explain
  the jargon numbers (common:insights.help.*)
- Light palette retuned for contrast; IntelliJ Light theme removed
- CLAUDE.md sync marker trimmed; its history moved to docs/CLAUDE-SYNC-LOG.md

Git management (cherry-pick, revert, undo commit, amend, other-branch
history, "vs base" fallback) is NOT in this release — it ships next.

Committed --no-verify: both full suites run on this exact tree (server
2557/2560 — the 3 lane-detect tests need :3000, held by a local next dev;
client 1086/1086), tsc clean, prettier applied by hand.

server/lib/pty-run.js

@@ -363,6 +363,12 @@ function spawnRun(args) {
     throw makeErr("EUNSUPPORTED", `${tool} cannot start a session in its own worktree`);
   }
   const proxyProfile = resolveProxy(tool, proxy); // ENOTFOUND, EUNSUPPORTED
+  // A Claude session on the vendor's own API runs on the least-loaded pool
+  // account, if the admin added any (claude-pool.js); an AI Proxy brings its
+  // own key, and an empty pool leaves the machine's login in charge.
+  const poolAccount =
+    entry.launcher === "claude" && !proxyProfile ? require("./claude-pool").pickAccount() : null;
+  const paneCred = require("./auth").newPaneToken();
   if (forkSession === true) {
     if (!resumeSessionId) throw makeErr("EBADSESSION", "a fork needs resumeSessionId");
     if (entry.launcher !== "claude") {
@@ -450,6 +456,8 @@ function spawnRun(args) {
       resumeSessionId: resumeSessionId || null,
       worktree: worktree === true || inWorktree === true,
       proxy: proxyProfile ? proxyProfile.name : null,
+      account: poolAccount ? poolAccount.name : null,
+      paneTokenHash: paneCred ? paneCred.hash : null,
       prompt: initialPrompt || "",
       status: "running",
       startedAt,
@@ -491,6 +499,12 @@ function spawnRun(args) {
     // pushes lines into history its redraw cannot clear). The user's own
     // `"tui"` setting decides; under fullscreen the pane scrolls in Claude.
     ...proxySpawn.env,
+    // The pool account's setup-token: outranks the machine's `/login` for
+    // this process only. Through tmux `-e`, never typed into the pane.
+    ...(poolAccount ? { CLAUDE_CODE_OAUTH_TOKEN: poolAccount.token } : {}),
+    // Server mode: the CLI, MCP server and statusline in this pane act as the
+    // workspace's owner with it (server/lib/auth.js userFromPaneToken).
+    ...(paneCred ? { AGENTHUB_PANE_TOKEN: paneCred.token } : {}),
     ...(bypass === true && entry.bypassEnv ? entry.bypassEnv : {}),
   };
 
@@ -557,11 +571,13 @@ function spawnShell({ laneId, slot = 0, cwd }) {
   }
   if (!tmux.isTmuxAvailable()) throw makeErr("ETMUXMISSING", "tmux is not installed");
   const id = runIdForLane(laneId, slot);
+  const paneCred = require("./auth").newPaneToken();
   const env = {
     AGENTHUB_LANE_ID: String(laneId),
     AGENTHUB_RUN_ID: id,
     ...(process.env.PATH ? { PATH: process.env.PATH } : {}),
     ...desktopEnv(),
+    ...(paneCred ? { AGENTHUB_PANE_TOKEN: paneCred.token } : {}),
   };
   // Started once the pane has its real size (WAIT_FOR_CLIENT, issue #55), as
   // the login shell tmux would have run (tmux sets SHELL in the pane).
@@ -578,6 +594,7 @@ function spawnShell({ laneId, slot = 0, cwd }) {
     resumeSessionId: null,
     worktree: false,
     proxy: null,
+    paneTokenHash: paneCred ? paneCred.hash : null,
     prompt: "",
     status: "running",
     startedAt: Date.now(),
@@ -599,9 +616,8 @@ function killRun(id) {
   return true;
 }
 
-function publicRun(id) {
+function publicRun(id, live = tmux.hasSession(id)) {
   const laneId = laneIdFromRunId(id);
-  const live = tmux.hasSession(id);
   const row = dashboardRuns ? dashboardRuns.getRun(id) : null;
   return {
     id,
@@ -627,9 +643,12 @@ function getRun(id) {
   return publicRun(id);
 }
 
-/** Computed fresh from tmux state every call — see file header. */
+/**
+ * Computed fresh from tmux state every call — see file header. A listed
+ * session is live by definition, so no has-session per row.
+ */
 function listRuns() {
-  return tmux.listSessions("agenthub-lane-").map(publicRun);
+  return tmux.listSessions("agenthub-lane-").map((id) => publicRun(id, true));
 }
 
 module.exports = {