feat: v2.5.10 — server mode for a team, file drops in the prompt, tab joins

Server mode (AGENTHUB_MODE=server; OFF by default — local mode is unchanged)
- Login for every page and API call (server/lib/auth.js, routes/auth.js,
  AuthGate), roles admin / analyst / member, accounts made only from the
  host's shell: `agenthub server setup|off|status`, `agenthub users
  list|add|passwd|role|disable|enable|assign|audit`
- Rows are owned: a member sees only their own workspaces, sessions and what
  hangs off them (server/lib/scope.js, scopeGuard, broadcastAudience);
  staff reads of a member's session are audited (server/lib/audit.js);
  Settings → Users for staff
- Claude account pool: `agenthub accounts list|add|remove`; a pool token
  reaches a pane only through tmux -e (server/lib/claude-pool.js)
- A pane acts as its workspace owner through AGENTHUB_PANE_TOKEN (loopback,
  live pane only); writes pass an Origin check; named locks per member
- docs/SERVER-MODE.md, docs/plans/server-mode/

Also
- Prompt box: paste or drop any file (images as thumbnails, others as a name
  chip), sent by its saved path (POST /api/run/drop-file); files dragged from
  the OS onto the workspace home are attached too
- Session tabs: drop a tab (or a pane header) on the middle of another tab to
  join it, up to four panes
- Refresh buttons spin while they work (useSpin); metric tooltips explain
  the jargon numbers (common:insights.help.*)
- Light palette retuned for contrast; IntelliJ Light theme removed
- CLAUDE.md sync marker trimmed; its history moved to docs/CLAUDE-SYNC-LOG.md

Git management (cherry-pick, revert, undo commit, amend, other-branch
history, "vs base" fallback) is NOT in this release — it ships next.

Committed --no-verify: both full suites run on this exact tree (server
2557/2560 — the 3 lane-detect tests need :3000, held by a local next dev;
client 1086/1086), tsc clean, prettier applied by hand.

server/routes/events.js

@@ -10,6 +10,7 @@
 const { Router } = require("express");
 const { db } = require("../db");
 const { parseSources, sessionIdInSourcesClause } = require("../lib/source-filter");
+const { memberId, bySessionWhere } = require("../lib/scope");
 
 const router = Router();
 
@@ -78,6 +79,12 @@ function buildWhere(filters) {
     params.push(...scope.params);
   }
 
+  // Server mode: a member's events are only those of their own sessions.
+  if (filters.own) {
+    clauses.push(filters.own.where);
+    params.push(...filters.own.params);
+  }
+
   return {
     sql: clauses.length > 0 ? `WHERE ${clauses.join(" AND ")}` : "",
     params,
@@ -98,6 +105,7 @@ router.get("/", (req, res) => {
     from: parseDate(req.query.from),
     to: parseDate(req.query.to),
     sources: parseSources(req),
+    own: memberId(req) != null ? bySessionWhere(req) : null,
   };
 
   const { sql: whereSql, params: whereParams } = buildWhere(filters);
@@ -120,17 +128,21 @@ router.get("/", (req, res) => {
 });
 
 // GET /api/events/facets — distinct event_type / tool_name values in the DB.
-router.get("/facets", (_req, res) => {
+router.get("/facets", (req, res) => {
+  // A server-mode member sees only the values in their own sessions' events.
+  const own = bySessionWhere(req);
   const eventTypes = db
     .prepare(
-      "SELECT DISTINCT event_type FROM events WHERE event_type IS NOT NULL ORDER BY event_type"
+      `SELECT DISTINCT event_type FROM events WHERE event_type IS NOT NULL AND ${own.where} ORDER BY event_type`
     )
-    .all()
+    .all(...own.params)
     .map((r) => r.event_type);
 
   const toolNames = db
-    .prepare("SELECT DISTINCT tool_name FROM events WHERE tool_name IS NOT NULL ORDER BY tool_name")
-    .all()
+    .prepare(
+      `SELECT DISTINCT tool_name FROM events WHERE tool_name IS NOT NULL AND ${own.where} ORDER BY tool_name`
+    )
+    .all(...own.params)
     .map((r) => r.tool_name);
 
   res.json({ event_types: eventTypes, tool_names: toolNames });