feat: v2.5.10 — server mode for a team, file drops in the prompt, tab joins

Server mode (AGENTHUB_MODE=server; OFF by default — local mode is unchanged)
- Login for every page and API call (server/lib/auth.js, routes/auth.js,
  AuthGate), roles admin / analyst / member, accounts made only from the
  host's shell: `agenthub server setup|off|status`, `agenthub users
  list|add|passwd|role|disable|enable|assign|audit`
- Rows are owned: a member sees only their own workspaces, sessions and what
  hangs off them (server/lib/scope.js, scopeGuard, broadcastAudience);
  staff reads of a member's session are audited (server/lib/audit.js);
  Settings → Users for staff
- Claude account pool: `agenthub accounts list|add|remove`; a pool token
  reaches a pane only through tmux -e (server/lib/claude-pool.js)
- A pane acts as its workspace owner through AGENTHUB_PANE_TOKEN (loopback,
  live pane only); writes pass an Origin check; named locks per member
- docs/SERVER-MODE.md, docs/plans/server-mode/

Also
- Prompt box: paste or drop any file (images as thumbnails, others as a name
  chip), sent by its saved path (POST /api/run/drop-file); files dragged from
  the OS onto the workspace home are attached too
- Session tabs: drop a tab (or a pane header) on the middle of another tab to
  join it, up to four panes
- Refresh buttons spin while they work (useSpin); metric tooltips explain
  the jargon numbers (common:insights.help.*)
- Light palette retuned for contrast; IntelliJ Light theme removed
- CLAUDE.md sync marker trimmed; its history moved to docs/CLAUDE-SYNC-LOG.md

Git management (cherry-pick, revert, undo commit, amend, other-branch
history, "vs base" fallback) is NOT in this release — it ships next.

Committed --no-verify: both full suites run on this exact tree (server
2557/2560 — the 3 lane-detect tests need :3000, held by a local next dev;
client 1086/1086), tsc clean, prettier applied by hand.

server/lib/workflow-stats.js

@@ -23,14 +23,27 @@ function durationSec(s) {
 // ═══════════════════════════════════════════════════
 
 /**
- * Build a SQL WHERE clause for the session filters `{status, tool, range}`
- * (`range` = `parseRange`'s result: sessions started in it).
+ * Build a SQL WHERE clause for the session filters `{status, tool, range,
+ * member}` (`range` = `parseRange`'s result: sessions started in it; `member`
+ * = `scope.memberId(req)`, a server-mode member's user id, whose own sessions
+ * are the only ones read — null reads every session).
  * Returns { clause, params } where clause is empty or " AND s.status = ? …".
  * Use `alias` to match the sessions table alias used in your query (default "s").
  */
 function statusClause(filter, alias = "s") {
   const parts = [];
   const params = [];
+  if (filter?.member != null) {
+    // A pure SQL builder: scope.js opens the db only for its canSee* checks,
+    // so this also runs in the read worker on its own connection.
+    const w = require("./scope").sessionWhere(
+      { user: { id: filter.member, role: "member" } },
+      `${alias}.id`,
+      `${alias}.lane_id`
+    );
+    parts.push(w.where);
+    params.push(...w.params);
+  }
   if (filter?.status && filter.status !== "all") {
     parts.push(`${alias}.status = ?`);
     params.push(filter.status);
@@ -710,7 +723,7 @@ const WORKFLOW_SECTIONS = [
  * The GET /api/workflows bundle, or only the named sections of it.
  *
  * @param {object} conn SQLite connection (compat-sqlite Database)
- * @param {{status?: string|null, tool?: string|null, range?: object|null}|null} statusFilter
+ * @param {{status?: string|null, tool?: string|null, range?: object|null, member?: number|null}|null} statusFilter
  *   the session filters (see `statusClause`); null = every session
  * @param {string[]|null} sections subset of WORKFLOW_SECTIONS; null = all
  * @returns {object}