feat: v2.5.10 — server mode for a team, file drops in the prompt, tab joins

Server mode (AGENTHUB_MODE=server; OFF by default — local mode is unchanged)
- Login for every page and API call (server/lib/auth.js, routes/auth.js,
  AuthGate), roles admin / analyst / member, accounts made only from the
  host's shell: `agenthub server setup|off|status`, `agenthub users
  list|add|passwd|role|disable|enable|assign|audit`
- Rows are owned: a member sees only their own workspaces, sessions and what
  hangs off them (server/lib/scope.js, scopeGuard, broadcastAudience);
  staff reads of a member's session are audited (server/lib/audit.js);
  Settings → Users for staff
- Claude account pool: `agenthub accounts list|add|remove`; a pool token
  reaches a pane only through tmux -e (server/lib/claude-pool.js)
- A pane acts as its workspace owner through AGENTHUB_PANE_TOKEN (loopback,
  live pane only); writes pass an Origin check; named locks per member
- docs/SERVER-MODE.md, docs/plans/server-mode/

Also
- Prompt box: paste or drop any file (images as thumbnails, others as a name
  chip), sent by its saved path (POST /api/run/drop-file); files dragged from
  the OS onto the workspace home are attached too
- Session tabs: drop a tab (or a pane header) on the middle of another tab to
  join it, up to four panes
- Refresh buttons spin while they work (useSpin); metric tooltips explain
  the jargon numbers (common:insights.help.*)
- Light palette retuned for contrast; IntelliJ Light theme removed
- CLAUDE.md sync marker trimmed; its history moved to docs/CLAUDE-SYNC-LOG.md

Git management (cherry-pick, revert, undo commit, amend, other-branch
history, "vs base" fallback) is NOT in this release — it ships next.

Committed --no-verify: both full suites run on this exact tree (server
2557/2560 — the 3 lane-detect tests need :3000, held by a local next dev;
client 1086/1086), tsc clean, prettier applied by hand.

server/lib/same-origin.js

@@ -1,14 +1,18 @@
 /**
  * @file same-origin.js
- * @description Loopback-Origin guard for the routes that act on the machine
- * rather than on the dashboard's own database — spawning a process, or
- * writing a file into a directory the request names.
+ * @description Origin guard for the routes that act on the machine rather than
+ * on the dashboard's own database — spawning a process, or writing a file into
+ * a directory the request names — plus `isLocalRequest`, the "a browser on this
+ * very machine, not through a proxy" test.
  *
  * The dashboard binds to localhost, so any page in the user's browser can
  * reach it. Without this, a malicious site could POST to it and, say, drop a
  * CLAUDE.md full of instructions into a project the user later opens.
  *
- * Browser requests carry `Origin`; it must be a loopback host. Requests with
+ * Browser requests carry `Origin`; it must be a loopback host, or — for a
+ * dashboard served under an operator-allowed name (server mode behind a
+ * reverse proxy, `DASHBOARD_ALLOWED_HOSTS`) — exactly the request's own Host,
+ * which `hostGuard` has already checked against that allowlist. Requests with
  * no `Origin` (curl, the CLI) pass — they are not the drive-by case. `Referer`
  * is the fallback for older browsers.
  *
@@ -18,6 +22,8 @@
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
+const { isHostAllowed } = require("./security");
+
 const ALLOWED_ORIGIN_HOSTS = new Set(["localhost", "127.0.0.1", "::1", "0.0.0.0"]);
 
 function isLoopback(raw) {
@@ -28,23 +34,34 @@ function isLoopback(raw) {
   }
 }
 
-function sameOriginGuard(req, res, next) {
-  const origin = req.headers.origin;
-  if (origin) {
-    if (!isLoopback(origin)) {
-      return res.status(403).json({
-        error: { code: "EBADORIGIN", message: "cross-origin requests are not allowed" },
-      });
-    }
-    return next();
+/** `raw`'s host:port is the request's own Host, and that Host is allowed. */
+function isOwnHost(raw, req) {
+  const host = String(req.headers.host || "").toLowerCase();
+  try {
+    return Boolean(host) && new URL(raw).host.toLowerCase() === host && isHostAllowed(host);
+  } catch {
+    return false;
   }
-  const referer = req.headers.referer;
-  if (referer && !isLoopback(referer)) {
-    return res.status(403).json({
-      error: { code: "EBADORIGIN", message: "cross-origin requests are not allowed" },
-    });
-  }
-  return next();
 }
 
-module.exports = { sameOriginGuard, ALLOWED_ORIGIN_HOSTS };
+function sameOriginGuard(req, res, next) {
+  const raw = req.headers.origin || req.headers.referer;
+  if (!raw || isLoopback(raw) || isOwnHost(raw, req)) return next();
+  return res.status(403).json({
+    error: { code: "EBADORIGIN", message: "cross-origin requests are not allowed" },
+  });
+}
+
+/**
+ * The request came straight from this machine: a loopback socket and no
+ * forwarding header. A reverse proxy's requests arrive from loopback too, so a
+ * forwarding header counts as remote. An SSH tunnel carries none and cannot be
+ * told apart.
+ */
+function isLocalRequest(req) {
+  const addr = req.socket?.remoteAddress || "";
+  const proxied = req.headers["x-forwarded-for"] || req.headers.forwarded;
+  return !proxied && ["127.0.0.1", "::1", "::ffff:127.0.0.1"].includes(addr);
+}
+
+module.exports = { sameOriginGuard, isLocalRequest, ALLOWED_ORIGIN_HOSTS, isLoopback, isOwnHost };