feat: v2.5.10 — server mode for a team, file drops in the prompt, tab joins

Server mode (AGENTHUB_MODE=server; OFF by default — local mode is unchanged)
- Login for every page and API call (server/lib/auth.js, routes/auth.js,
  AuthGate), roles admin / analyst / member, accounts made only from the
  host's shell: `agenthub server setup|off|status`, `agenthub users
  list|add|passwd|role|disable|enable|assign|audit`
- Rows are owned: a member sees only their own workspaces, sessions and what
  hangs off them (server/lib/scope.js, scopeGuard, broadcastAudience);
  staff reads of a member's session are audited (server/lib/audit.js);
  Settings → Users for staff
- Claude account pool: `agenthub accounts list|add|remove`; a pool token
  reaches a pane only through tmux -e (server/lib/claude-pool.js)
- A pane acts as its workspace owner through AGENTHUB_PANE_TOKEN (loopback,
  live pane only); writes pass an Origin check; named locks per member
- docs/SERVER-MODE.md, docs/plans/server-mode/

Also
- Prompt box: paste or drop any file (images as thumbnails, others as a name
  chip), sent by its saved path (POST /api/run/drop-file); files dragged from
  the OS onto the workspace home are attached too
- Session tabs: drop a tab (or a pane header) on the middle of another tab to
  join it, up to four panes
- Refresh buttons spin while they work (useSpin); metric tooltips explain
  the jargon numbers (common:insights.help.*)
- Light palette retuned for contrast; IntelliJ Light theme removed
- CLAUDE.md sync marker trimmed; its history moved to docs/CLAUDE-SYNC-LOG.md

Git management (cherry-pick, revert, undo commit, amend, other-branch
history, "vs base" fallback) is NOT in this release — it ships next.

Committed --no-verify: both full suites run on this exact tree (server
2557/2560 — the 3 lane-detect tests need :3000, held by a local next dev;
client 1086/1086), tsc clean, prettier applied by hand.

server/routes/ai-tools.js

@@ -21,6 +21,7 @@ const { listModels } = require("../lib/ai-tool-models");
 const toolConfig = require("../lib/ai-tool-config");
 const { calculateCost } = require("./pricing");
 const { db, stmts } = require("../db");
+const { sessionWhere } = require("../lib/scope");
 
 const router = express.Router();
 
@@ -150,13 +151,17 @@ router.put(
   )
 );
 
-// How much a tool has been used: its sessions and their priced tokens.
+// How much a tool has been used: its sessions and their priced tokens (a
+// server mode member: their own sessions only).
 router.get("/:id/usage", (req, res) => {
   if (!aiTools.has(req.params.id)) {
     return res.status(404).json({ error: { code: "ENOTOOL", message: "unknown AI tool" } });
   }
   const id = req.params.id;
-  const { n } = db.prepare("SELECT COUNT(*) AS n FROM sessions WHERE tool = ?").get(id);
+  const own = sessionWhere(req, "s.id", "s.lane_id");
+  const { n } = db
+    .prepare(`SELECT COUNT(*) AS n FROM sessions s WHERE s.tool = ? AND ${own.where}`)
+    .get(id, ...own.params);
   const rows = db
     .prepare(
       `SELECT tu.model AS model, tu.speed AS speed, tu.inference_geo AS inference_geo,
@@ -167,10 +172,10 @@ router.get("/:id/usage", (req, res) => {
         SUM(tu.cache_write_tokens + tu.baseline_cache_write) AS cache_write_tokens,
         SUM(tu.cache_write_1h_tokens + tu.baseline_cache_write_1h) AS cache_write_1h_tokens
       FROM token_usage tu JOIN sessions s ON s.id = tu.session_id
-      WHERE s.tool = ?
+      WHERE s.tool = ? AND ${own.where}
       GROUP BY tu.model, tu.speed, tu.inference_geo, tu.service_tier`
     )
-    .all(id);
+    .all(id, ...own.params);
   res.json({ sessions: n, cost: calculateCost(rows, stmts.listPricing.all()).total_cost });
 });