feat: v2.5.10 — server mode for a team, file drops in the prompt, tab joins

Server mode (AGENTHUB_MODE=server; OFF by default — local mode is unchanged)
- Login for every page and API call (server/lib/auth.js, routes/auth.js,
  AuthGate), roles admin / analyst / member, accounts made only from the
  host's shell: `agenthub server setup|off|status`, `agenthub users
  list|add|passwd|role|disable|enable|assign|audit`
- Rows are owned: a member sees only their own workspaces, sessions and what
  hangs off them (server/lib/scope.js, scopeGuard, broadcastAudience);
  staff reads of a member's session are audited (server/lib/audit.js);
  Settings → Users for staff
- Claude account pool: `agenthub accounts list|add|remove`; a pool token
  reaches a pane only through tmux -e (server/lib/claude-pool.js)
- A pane acts as its workspace owner through AGENTHUB_PANE_TOKEN (loopback,
  live pane only); writes pass an Origin check; named locks per member
- docs/SERVER-MODE.md, docs/plans/server-mode/

Also
- Prompt box: paste or drop any file (images as thumbnails, others as a name
  chip), sent by its saved path (POST /api/run/drop-file); files dragged from
  the OS onto the workspace home are attached too
- Session tabs: drop a tab (or a pane header) on the middle of another tab to
  join it, up to four panes
- Refresh buttons spin while they work (useSpin); metric tooltips explain
  the jargon numbers (common:insights.help.*)
- Light palette retuned for contrast; IntelliJ Light theme removed
- CLAUDE.md sync marker trimmed; its history moved to docs/CLAUDE-SYNC-LOG.md

Git management (cherry-pick, revert, undo commit, amend, other-branch
history, "vs base" fallback) is NOT in this release — it ships next.

Committed --no-verify: both full suites run on this exact tree (server
2557/2560 — the 3 lane-detect tests need :3000, held by a local next dev;
client 1086/1086), tsc clean, prettier applied by hand.

server/routes/sessions.js

@@ -11,6 +11,7 @@ const { stmts, db } = require("../db");
 const { broadcast } = require("../websocket");
 const { calculateCost, attachAgentCosts } = require("./pricing");
 const { parseSources, sourceColumnClause } = require("../lib/source-filter");
+const { memberId, sessionWhere, canSeeSession } = require("../lib/scope");
 const {
   getClaudeHome,
   getProjectsDir,
@@ -220,6 +221,12 @@ router.get("/", (req, res) => {
     where.push(sourceFilter.clause);
     params.push(...sourceFilter.params);
   }
+  // Server mode: a member lists only their own workspaces' sessions.
+  if (memberId(req) != null) {
+    const own = sessionWhere(req, "s.id", "s.lane_id");
+    where.push(own.where);
+    params.push(...own.params);
+  }
 
   const whereSql = where.length > 0 ? `WHERE ${where.join(" AND ")}` : "";
   const total = db.prepare(`SELECT COUNT(*) as c FROM sessions s ${whereSql}`).get(...params).c;
@@ -290,13 +297,24 @@ router.get("/", (req, res) => {
   res.json({ sessions: rows, limit, offset, total });
 });
 
-router.get("/facets", (_req, res) => {
+router.get("/facets", (req, res) => {
+  const own = sessionWhere(req);
   const rows = db
-    .prepare("SELECT DISTINCT cwd FROM sessions WHERE cwd IS NOT NULL AND cwd != '' ORDER BY cwd")
-    .all();
+    .prepare(
+      `SELECT DISTINCT cwd FROM sessions WHERE cwd IS NOT NULL AND cwd != '' AND ${own.where} ORDER BY cwd`
+    )
+    .all(...own.params);
   // Distinct origins present in the data, so the UI can offer a source facet /
   // scope selector. Always includes at least 'local' (the column default).
-  const sources = stmts.distinctSessionSources.all().map((r) => r.source);
+  const sources = (
+    memberId(req) == null
+      ? stmts.distinctSessionSources.all()
+      : db
+          .prepare(
+            `SELECT DISTINCT source FROM sessions WHERE source IS NOT NULL AND source != '' AND ${own.where} ORDER BY source`
+          )
+          .all(...own.params)
+  ).map((r) => r.source);
   res.json({ cwds: rows.map((r) => r.cwd), sources });
 });
 
@@ -405,6 +423,13 @@ function sessionStats(sessionId) {
 }
 
 router.post("/", (req, res) => {
+  // Server mode: sessions come from hooks and the dashboard's own panes; a
+  // member hand-making one would plant an unowned row every admin sees.
+  if (memberId(req) != null) {
+    return res
+      .status(403)
+      .json({ error: { code: "EADMIN", message: "a member cannot create a session directly" } });
+  }
   const { id, name, cwd, model, metadata } = req.body;
   if (!id) {
     return res.status(400).json({ error: { code: "INVALID_INPUT", message: "id is required" } });
@@ -412,6 +437,10 @@ router.post("/", (req, res) => {
 
   const existing = stmts.getSession.get(id);
   if (existing) {
+    // A member may not read another's session by naming its id here.
+    if (!canSeeSession(req, id)) {
+      return res.status(404).json({ error: { code: "NOT_FOUND", message: "Session not found" } });
+    }
     return res.json({ session: existing, created: false });
   }
 
@@ -667,6 +696,15 @@ router.get("/:id/transcript", async (req, res) => {
 
   const agentId = req.query.agent_id || null;
   const runId = req.query.run_id || null;
+  // Both are joined into a file path below: one plain name each, never a path.
+  const SAFE_ID = /^[\w.-]{1,200}$/;
+  for (const v of [agentId, runId]) {
+    if (v !== null && (typeof v !== "string" || !SAFE_ID.test(v) || v.includes(".."))) {
+      return res
+        .status(400)
+        .json({ error: { code: "EBADID", message: "invalid agent_id or run_id" } });
+    }
+  }
   // Subagent transcripts (anything but the main session file) need different
   // sender attribution: their first user line is the orchestrator's task.
   const isSubagentFile = !!(agentId && agentId !== "main");