feat: v2.5.10 — server mode for a team, file drops in the prompt, tab joins

Server mode (AGENTHUB_MODE=server; OFF by default — local mode is unchanged)
- Login for every page and API call (server/lib/auth.js, routes/auth.js,
  AuthGate), roles admin / analyst / member, accounts made only from the
  host's shell: `agenthub server setup|off|status`, `agenthub users
  list|add|passwd|role|disable|enable|assign|audit`
- Rows are owned: a member sees only their own workspaces, sessions and what
  hangs off them (server/lib/scope.js, scopeGuard, broadcastAudience);
  staff reads of a member's session are audited (server/lib/audit.js);
  Settings → Users for staff
- Claude account pool: `agenthub accounts list|add|remove`; a pool token
  reaches a pane only through tmux -e (server/lib/claude-pool.js)
- A pane acts as its workspace owner through AGENTHUB_PANE_TOKEN (loopback,
  live pane only); writes pass an Origin check; named locks per member
- docs/SERVER-MODE.md, docs/plans/server-mode/

Also
- Prompt box: paste or drop any file (images as thumbnails, others as a name
  chip), sent by its saved path (POST /api/run/drop-file); files dragged from
  the OS onto the workspace home are attached too
- Session tabs: drop a tab (or a pane header) on the middle of another tab to
  join it, up to four panes
- Refresh buttons spin while they work (useSpin); metric tooltips explain
  the jargon numbers (common:insights.help.*)
- Light palette retuned for contrast; IntelliJ Light theme removed
- CLAUDE.md sync marker trimmed; its history moved to docs/CLAUDE-SYNC-LOG.md

Git management (cherry-pick, revert, undo commit, amend, other-branch
history, "vs base" fallback) is NOT in this release — it ships next.

Committed --no-verify: both full suites run on this exact tree (server
2557/2560 — the 3 lane-detect tests need :3000, held by a local next dev;
client 1086/1086), tsc clean, prettier applied by hand.

server/lib/source-filter.js

@@ -12,7 +12,9 @@
  * subquery so complex aggregate SQL (stats, analytics) needs only one extra AND.
  *
  * `?tool=<id>` (an AI Tools catalog id, matched against `sessions.tool`) narrows
- * the same way; `parseScope` folds both into one predicate over `sessions`.
+ * the same way; `parseScope` folds both into one predicate over `sessions`,
+ * plus — in server mode, for a member — the member's own sessions
+ * (`sessionWhere`, server/lib/scope.js), so no request can widen past them.
  *
  * `?from=&to=` (local `YYYY-MM-DD`, inclusive, read with `tz_offset`) is a date
  * range: `parseRange` turns it into the UTC instants a timestamp column is
@@ -21,6 +23,8 @@
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
+const { sessionWhere } = require("./scope");
+
 /**
  * Parse the `sources` query param into a de-duplicated list, or null for
  * "all sources" (no filtering).
@@ -85,9 +89,9 @@ function parseTool(req) {
 }
 
 /**
- * The data scope (sources and/or tool) as ONE predicate over `sessions` with
- * unqualified columns, or null for "everything". Callers check `parseTool` for
- * false first.
+ * The data scope (sources and/or tool, and a member's own sessions) as ONE
+ * predicate over `sessions` with unqualified columns, or null for "everything"
+ * — never null for a member. Callers check `parseTool` for false first.
  * @param {import("express").Request} req
  * @returns {{where:string, params:string[]}|null}
  */
@@ -104,6 +108,11 @@ function parseScope(req) {
     where.push("tool = ?");
     params.push(tool);
   }
+  const own = sessionWhere(req);
+  if (own.where !== "1") {
+    where.push(own.where);
+    params.push(...own.params);
+  }
   return where.length ? { where: where.join(" AND "), params } : null;
 }