feat: v2.5.12 — plan and quota for every AI tool, Grok Build and Kimi Code, Quit AgentHub (#65)

Usage panel (status bar):
- every account shows its plan (Claude subscriptionType, Codex
  chatgpt_plan_type, Cursor membershipType, Grok subscriptionTier)
- new quota rows: Cursor CLI (cursor.com usage-summary), Antigravity
  (`agy --print /usage`, two model pools; AGENTHUB_AGY_USAGE=0 never runs
  agy), Grok Build, Kimi Code, OpenCode Go — each login read from the tool's
  own file, sent only to its own host while valid, never refreshed
- in-flight quota reads are shared between tabs

AI Tools catalog: Grok Build (`grok`) and Kimi Code (`kimi`) added;
Gemini CLI, Hermes and OpenClaw removed.

Also: Quit AgentHub (#65, `agenthub stop`), status-area icon, Add to Chat
on an editor selection, Settings in three groups, JetBrains-style Changes
panel (ticked files/hunks, ignore, blame, file history), terminal font.

--no-verify: :3000 is taken by another dev server (lane-detect tests);
both suites run by hand — server 2636/2639 (the 3 are :3000), client
1131/1131.

server/lib/auth.js

@@ -14,6 +14,9 @@
  *   its own bearer token), and everything else only with a valid login. An
  *   `analyst` may only read; writes under `ADMIN_WRITE_PREFIXES` — the host
  *   account's own configuration — are an `admin`'s.
+ * - Accounts are made from the host's shell (`agenthub users …`) or by an
+ *   admin on the Users page (`server/routes/users.js`), where every change
+ *   needs the admin's own password again (`confirmPassword`, throttled).
  *
  * This is login, not isolation: every member still sees every workspace and
  * session, and every pane runs as the one host account (phases S2/S3 of the
@@ -54,6 +57,7 @@ const ADMIN_WRITE_PREFIXES = [
   "/remote-sources",
   "/reports",
   "/pets",
+  "/users",
 ];
 
 /**
@@ -291,6 +295,21 @@ async function login(req, username, password) {
   return { user: publicUser(u), token: startSession(u.id) };
 }
 
+/**
+ * Step-up check for an account change made in the dashboard: the acting
+ * user's OWN password again, so a login left open (or a page that rode it)
+ * cannot create an admin. Throttled like a login; throws EREAUTH/ETOOMANY.
+ */
+async function confirmPassword(user, password) {
+  const key = `reauth:${user.id}`;
+  if (blocked(key, FAIL_LIMIT)) throw err("ETOOMANY", "too many wrong passwords, try again later");
+  noteAttempt(key);
+  const row = sql("SELECT password_hash FROM users WHERE id = ?").get(user.id);
+  const ok = await verifyPassword(String(password || ""), row?.password_hash || DUMMY_HASH);
+  if (!row || !ok) throw err("EREAUTH", "your password is wrong");
+  failures.delete(key);
+}
+
 // ── Pane credentials ────────────────────────────────────────────────────────
 
 const PANE_HEADER = "x-agenthub-pane-token";
@@ -446,6 +465,7 @@ module.exports = {
   hasAdmin,
   userFromRequest,
   login,
+  confirmPassword,
   endSession,
   cookieToken,
   setLoginCookie,