feat: v2.5.10 — server mode for a team, file drops in the prompt, tab joins

Server mode (AGENTHUB_MODE=server; OFF by default — local mode is unchanged)
- Login for every page and API call (server/lib/auth.js, routes/auth.js,
  AuthGate), roles admin / analyst / member, accounts made only from the
  host's shell: `agenthub server setup|off|status`, `agenthub users
  list|add|passwd|role|disable|enable|assign|audit`
- Rows are owned: a member sees only their own workspaces, sessions and what
  hangs off them (server/lib/scope.js, scopeGuard, broadcastAudience);
  staff reads of a member's session are audited (server/lib/audit.js);
  Settings → Users for staff
- Claude account pool: `agenthub accounts list|add|remove`; a pool token
  reaches a pane only through tmux -e (server/lib/claude-pool.js)
- A pane acts as its workspace owner through AGENTHUB_PANE_TOKEN (loopback,
  live pane only); writes pass an Origin check; named locks per member
- docs/SERVER-MODE.md, docs/plans/server-mode/

Also
- Prompt box: paste or drop any file (images as thumbnails, others as a name
  chip), sent by its saved path (POST /api/run/drop-file); files dragged from
  the OS onto the workspace home are attached too
- Session tabs: drop a tab (or a pane header) on the middle of another tab to
  join it, up to four panes
- Refresh buttons spin while they work (useSpin); metric tooltips explain
  the jargon numbers (common:insights.help.*)
- Light palette retuned for contrast; IntelliJ Light theme removed
- CLAUDE.md sync marker trimmed; its history moved to docs/CLAUDE-SYNC-LOG.md

Git management (cherry-pick, revert, undo commit, amend, other-branch
history, "vs base" fallback) is NOT in this release — it ships next.

Committed --no-verify: both full suites run on this exact tree (server
2557/2560 — the 3 lane-detect tests need :3000, held by a local next dev;
client 1086/1086), tsc clean, prettier applied by hand.

server/routes/alerts.js

@@ -7,7 +7,7 @@
 
 const { Router } = require("express");
 const { v4: uuidv4 } = require("uuid");
-const { stmts } = require("../db");
+const { stmts, db } = require("../db");
 const { broadcast } = require("../websocket");
 const {
   RULE_TYPES,
@@ -15,6 +15,7 @@ const {
   invalidateRuleCache,
   previewRule,
 } = require("../lib/alerts");
+const { memberId, bySessionWhere } = require("../lib/scope");
 
 const router = Router();
 
@@ -150,6 +151,31 @@ router.get("/", (req, res) => {
   const offset = Math.max(0, parseInt(req.query.offset, 10) || 0);
   const unackedOnly = req.query.unacked === "true";
 
+  if (memberId(req) != null) {
+    // Server mode: a member's feed is their own sessions' alerts; one with no
+    // session (a budget, a global threshold) is staff-only.
+    const own = bySessionWhere(req);
+    const count = (extra) =>
+      db
+        .prepare(`SELECT COUNT(*) as count FROM alert_events WHERE ${own.where}${extra}`)
+        .get(...own.params).count;
+    const unackedSql = " AND acknowledged_at IS NULL";
+    const alerts = db
+      .prepare(
+        `SELECT * FROM alert_events WHERE ${own.where}${unackedOnly ? unackedSql : ""}
+         ORDER BY triggered_at DESC, id DESC LIMIT ? OFFSET ?`
+      )
+      .all(...own.params, limit, offset);
+    const unacked = count(unackedSql);
+    return res.json({
+      alerts,
+      total: unackedOnly ? unacked : count(""),
+      unacked,
+      limit,
+      offset,
+    });
+  }
+
   const alerts = unackedOnly
     ? stmts.listUnackedAlertEvents.all(limit, offset)
     : stmts.listAlertEvents.all(limit, offset);
@@ -174,8 +200,18 @@ router.post("/:id(\\d+)/ack", (req, res) => {
 });
 
 // POST /api/alerts/ack-all - Acknowledge every unacked alert
-router.post("/ack-all", (_req, res) => {
-  const info = stmts.ackAllAlertEvents.run();
+router.post("/ack-all", (req, res) => {
+  // A server-mode member acknowledges only their own sessions' alerts.
+  const own = bySessionWhere(req);
+  const info =
+    memberId(req) == null
+      ? stmts.ackAllAlertEvents.run()
+      : db
+          .prepare(
+            `UPDATE alert_events SET acknowledged_at = strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+             WHERE acknowledged_at IS NULL AND ${own.where}`
+          )
+          .run(...own.params);
   if (info.changes > 0) broadcast("alert_updated", { acked_all: true });
   res.json({ ok: true, acknowledged: info.changes });
 });