feat: v2.5.10 — server mode for a team, file drops in the prompt, tab joins

Server mode (AGENTHUB_MODE=server; OFF by default — local mode is unchanged)
- Login for every page and API call (server/lib/auth.js, routes/auth.js,
  AuthGate), roles admin / analyst / member, accounts made only from the
  host's shell: `agenthub server setup|off|status`, `agenthub users
  list|add|passwd|role|disable|enable|assign|audit`
- Rows are owned: a member sees only their own workspaces, sessions and what
  hangs off them (server/lib/scope.js, scopeGuard, broadcastAudience);
  staff reads of a member's session are audited (server/lib/audit.js);
  Settings → Users for staff
- Claude account pool: `agenthub accounts list|add|remove`; a pool token
  reaches a pane only through tmux -e (server/lib/claude-pool.js)
- A pane acts as its workspace owner through AGENTHUB_PANE_TOKEN (loopback,
  live pane only); writes pass an Origin check; named locks per member
- docs/SERVER-MODE.md, docs/plans/server-mode/

Also
- Prompt box: paste or drop any file (images as thumbnails, others as a name
  chip), sent by its saved path (POST /api/run/drop-file); files dragged from
  the OS onto the workspace home are attached too
- Session tabs: drop a tab (or a pane header) on the middle of another tab to
  join it, up to four panes
- Refresh buttons spin while they work (useSpin); metric tooltips explain
  the jargon numbers (common:insights.help.*)
- Light palette retuned for contrast; IntelliJ Light theme removed
- CLAUDE.md sync marker trimmed; its history moved to docs/CLAUDE-SYNC-LOG.md

Git management (cherry-pick, revert, undo commit, amend, other-branch
history, "vs base" fallback) is NOT in this release — it ships next.

Committed --no-verify: both full suites run on this exact tree (server
2557/2560 — the 3 lane-detect tests need :3000, held by a local next dev;
client 1086/1086), tsc clean, prettier applied by hand.

server/routes/agents.js

@@ -8,6 +8,7 @@ const { stmts, db } = require("../db");
 const { broadcast } = require("../websocket");
 const { attachAgentCosts } = require("./pricing");
 const { parseSources, sessionIdInSourcesClause } = require("../lib/source-filter");
+const { memberId, bySessionWhere } = require("../lib/scope");
 
 const router = Router();
 
@@ -41,12 +42,22 @@ router.get("/", (req, res) => {
   } else if (session_id) {
     // A session belongs to exactly one source, so no extra source filter needed.
     rows = stmts.listAgentsBySession.all(session_id);
-  } else if (sources) {
+  } else if (sources || memberId(req) != null) {
     // Data-scope active: build a dynamic query restricting agents to sessions
     // from the chosen machines. `agents` carries only session_id → subquery.
-    const scope = sessionIdInSourcesClause(sources, "session_id");
-    const clauses = [scope.clause];
-    const params = [...scope.params];
+    // A server-mode member gets only their own sessions' agents the same way.
+    const clauses = [];
+    const params = [];
+    const src = sessionIdInSourcesClause(sources, "session_id");
+    if (src.clause) {
+      clauses.push(src.clause);
+      params.push(...src.params);
+    }
+    if (memberId(req) != null) {
+      const own = bySessionWhere(req);
+      clauses.push(own.where);
+      params.push(...own.params);
+    }
     if (status) {
       clauses.push("status = ?");
       params.push(status);
@@ -85,6 +96,10 @@ router.post("/", (req, res) => {
   }
 
   const existing = stmts.getAgent.get(id);
+  // Server mode: another user's agent is "not found", not handed back.
+  if (existing && !require("../lib/scope").canSeeAgent(req, id)) {
+    return res.status(404).json({ error: { code: "ENOTFOUND", message: "not found" } });
+  }
   if (existing) {
     return res.json({ agent: existing, created: false });
   }