feat: v2.5.10 — server mode for a team, file drops in the prompt, tab joins

Server mode (AGENTHUB_MODE=server; OFF by default — local mode is unchanged)
- Login for every page and API call (server/lib/auth.js, routes/auth.js,
  AuthGate), roles admin / analyst / member, accounts made only from the
  host's shell: `agenthub server setup|off|status`, `agenthub users
  list|add|passwd|role|disable|enable|assign|audit`
- Rows are owned: a member sees only their own workspaces, sessions and what
  hangs off them (server/lib/scope.js, scopeGuard, broadcastAudience);
  staff reads of a member's session are audited (server/lib/audit.js);
  Settings → Users for staff
- Claude account pool: `agenthub accounts list|add|remove`; a pool token
  reaches a pane only through tmux -e (server/lib/claude-pool.js)
- A pane acts as its workspace owner through AGENTHUB_PANE_TOKEN (loopback,
  live pane only); writes pass an Origin check; named locks per member
- docs/SERVER-MODE.md, docs/plans/server-mode/

Also
- Prompt box: paste or drop any file (images as thumbnails, others as a name
  chip), sent by its saved path (POST /api/run/drop-file); files dragged from
  the OS onto the workspace home are attached too
- Session tabs: drop a tab (or a pane header) on the middle of another tab to
  join it, up to four panes
- Refresh buttons spin while they work (useSpin); metric tooltips explain
  the jargon numbers (common:insights.help.*)
- Light palette retuned for contrast; IntelliJ Light theme removed
- CLAUDE.md sync marker trimmed; its history moved to docs/CLAUDE-SYNC-LOG.md

Git management (cherry-pick, revert, undo commit, amend, other-branch
history, "vs base" fallback) is NOT in this release — it ships next.

Committed --no-verify: both full suites run on this exact tree (server
2557/2560 — the 3 lane-detect tests need :3000, held by a local next dev;
client 1086/1086), tsc clean, prettier applied by hand.

server/routes/settings.js

@@ -28,7 +28,13 @@ const { envOwned, applySetting } = require("../lib/settings-env");
 const privacy = require("../lib/privacy");
 const pushToken = require("../lib/push-token");
 const pricingSync = require("../lib/pricing-sync");
-const { EXPORT_FORMAT, EXPORT_VERSION, importExportBundle } = require("../lib/data-transfer");
+const {
+  EXPORT_FORMAT,
+  EXPORT_VERSION,
+  importExportBundle,
+  exportableRun,
+} = require("../lib/data-transfer");
+const { sessionWhere, bySessionWhere } = require("../lib/scope");
 
 function getDbSize() {
   try {
@@ -39,16 +45,19 @@ function getDbSize() {
   }
 }
 
-function getTableCounts() {
-  const tables = ["sessions", "agents", "events", "model_pricing"];
-  const counts = {};
-  for (const t of tables) {
-    counts[t] = db.prepare(`SELECT COUNT(*) as c FROM ${t}`).get().c;
-  }
-  counts.token_usage = db
-    .prepare("SELECT COUNT(DISTINCT session_id) as c FROM token_usage")
-    .get().c;
-  return counts;
+// `req` scopes the counts to a server-mode member's own rows (sessions,
+// agents, events, token usage); pricing is shared configuration, counted whole.
+function getTableCounts(req) {
+  const own = sessionWhere(req);
+  const bySession = bySessionWhere(req);
+  const count = (sql, w) => db.prepare(`${sql} WHERE ${w.where}`).get(...w.params).c;
+  return {
+    sessions: count("SELECT COUNT(*) as c FROM sessions", own),
+    agents: count("SELECT COUNT(*) as c FROM agents", bySession),
+    events: count("SELECT COUNT(*) as c FROM events", bySession),
+    model_pricing: db.prepare("SELECT COUNT(*) as c FROM model_pricing").get().c,
+    token_usage: count("SELECT COUNT(DISTINCT session_id) as c FROM token_usage", bySession),
+  };
 }
 
 function getHookStatus() {
@@ -98,7 +107,7 @@ function getHookStatus() {
 // GET /api/settings/info — system info, db stats, hook status
 router.get("/info", (req, res) => {
   const dbSize = getDbSize();
-  const counts = getTableCounts();
+  const counts = getTableCounts(req);
   const hookStatus = getHookStatus();
 
   // Advanced SQLite info
@@ -112,9 +121,12 @@ router.get("/info", (req, res) => {
   };
 
   // Recent activity load (events in last 5, 15, 60 minutes)
+  const ownEvents = bySessionWhere(req);
   const getCount = (ms) => {
     const d = new Date(Date.now() - ms).toISOString();
-    return db.prepare("SELECT COUNT(*) as c FROM events WHERE created_at > ?").get(d).c;
+    return db
+      .prepare(`SELECT COUNT(*) as c FROM events WHERE created_at > ? AND ${ownEvents.where}`)
+      .get(d, ...ownEvents.params).c;
   };
 
   const load_stats = {
@@ -357,7 +369,7 @@ router.get("/export", async (req, res) => {
     await write(
       field(
         "dashboard_runs",
-        db.prepare("SELECT * FROM dashboard_runs ORDER BY started_at DESC").all()
+        db.prepare("SELECT * FROM dashboard_runs ORDER BY started_at DESC").all().map(exportableRun)
       )
     );
     await write(