feat: v2.5.10 — server mode for a team, file drops in the prompt, tab joins

Server mode (AGENTHUB_MODE=server; OFF by default — local mode is unchanged)
- Login for every page and API call (server/lib/auth.js, routes/auth.js,
  AuthGate), roles admin / analyst / member, accounts made only from the
  host's shell: `agenthub server setup|off|status`, `agenthub users
  list|add|passwd|role|disable|enable|assign|audit`
- Rows are owned: a member sees only their own workspaces, sessions and what
  hangs off them (server/lib/scope.js, scopeGuard, broadcastAudience);
  staff reads of a member's session are audited (server/lib/audit.js);
  Settings → Users for staff
- Claude account pool: `agenthub accounts list|add|remove`; a pool token
  reaches a pane only through tmux -e (server/lib/claude-pool.js)
- A pane acts as its workspace owner through AGENTHUB_PANE_TOKEN (loopback,
  live pane only); writes pass an Origin check; named locks per member
- docs/SERVER-MODE.md, docs/plans/server-mode/

Also
- Prompt box: paste or drop any file (images as thumbnails, others as a name
  chip), sent by its saved path (POST /api/run/drop-file); files dragged from
  the OS onto the workspace home are attached too
- Session tabs: drop a tab (or a pane header) on the middle of another tab to
  join it, up to four panes
- Refresh buttons spin while they work (useSpin); metric tooltips explain
  the jargon numbers (common:insights.help.*)
- Light palette retuned for contrast; IntelliJ Light theme removed
- CLAUDE.md sync marker trimmed; its history moved to docs/CLAUDE-SYNC-LOG.md

Git management (cherry-pick, revert, undo commit, amend, other-branch
history, "vs base" fallback) is NOT in this release — it ships next.

Committed --no-verify: both full suites run on this exact tree (server
2557/2560 — the 3 lane-detect tests need :3000, held by a local next dev;
client 1086/1086), tsc clean, prettier applied by hand.

server/routes/push.js

@@ -1,5 +1,5 @@
 /**
- * @file Express router for managing push notifications, providing endpoints to retrieve the VAPID public key, subscribe/unsubscribe to push notifications, and send push notifications to all subscribers. It interacts with the database to store subscription details and uses a push library to send notifications.
+ * @file Express router for managing push notifications, providing endpoints to retrieve the VAPID public key, subscribe/unsubscribe to push notifications, and send push notifications to all subscribers (in server mode: only the logged-in user's own subscriptions). It interacts with the database to store subscription details and uses a push library to send notifications.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
@@ -19,8 +19,8 @@ router.post("/subscribe", (req, res) => {
     return res.status(400).json({ error: { message: "Missing required fields" } });
   }
   db.prepare(
-    "INSERT OR REPLACE INTO push_subscriptions (endpoint, p256dh, auth) VALUES (?, ?, ?)"
-  ).run(endpoint, keys.p256dh, keys.auth);
+    "INSERT OR REPLACE INTO push_subscriptions (endpoint, p256dh, auth, user_id) VALUES (?, ?, ?, ?)"
+  ).run(endpoint, keys.p256dh, keys.auth, req.user ? req.user.id : null);
   res.json({ ok: true });
 });
 
@@ -29,7 +29,15 @@ router.delete("/subscribe", (req, res) => {
   if (!endpoint) {
     return res.status(400).json({ error: { message: "Missing endpoint" } });
   }
-  db.prepare("DELETE FROM push_subscriptions WHERE endpoint = ?").run(endpoint);
+  // Server mode: only one's own subscription.
+  if (req.user) {
+    db.prepare("DELETE FROM push_subscriptions WHERE endpoint = ? AND user_id = ?").run(
+      endpoint,
+      req.user.id
+    );
+  } else {
+    db.prepare("DELETE FROM push_subscriptions WHERE endpoint = ?").run(endpoint);
+  }
   res.json({ ok: true });
 });
 
@@ -43,7 +51,13 @@ router.post("/send", async (req, res) => {
     //   { native: true|false, pushed: <count>, failed: <count> }
     // so a silent "no subscribers, no Electron host" no-op stops looking like
     // success on the client side.
-    const result = await sendPushToAll(db, title, body, typeof url === "string" ? url : undefined);
+    const result = await sendPushToAll(
+      db,
+      title,
+      body,
+      typeof url === "string" ? url : undefined,
+      req.user ? req.user.id : null
+    );
     res.json({ ok: true, ...result });
   } catch (err) {
     res.status(500).json({ error: { message: err.message } });