feat: v2.5.12 — plan and quota for every AI tool, Grok Build and Kimi Code, Quit AgentHub (#65)

Usage panel (status bar):
- every account shows its plan (Claude subscriptionType, Codex
  chatgpt_plan_type, Cursor membershipType, Grok subscriptionTier)
- new quota rows: Cursor CLI (cursor.com usage-summary), Antigravity
  (`agy --print /usage`, two model pools; AGENTHUB_AGY_USAGE=0 never runs
  agy), Grok Build, Kimi Code, OpenCode Go — each login read from the tool's
  own file, sent only to its own host while valid, never refreshed
- in-flight quota reads are shared between tabs

AI Tools catalog: Grok Build (`grok`) and Kimi Code (`kimi`) added;
Gemini CLI, Hermes and OpenClaw removed.

Also: Quit AgentHub (#65, `agenthub stop`), status-area icon, Add to Chat
on an editor selection, Settings in three groups, JetBrains-style Changes
panel (ticked files/hunks, ignore, blame, file history), terminal font.

--no-verify: :3000 is taken by another dev server (lane-detect tests);
both suites run by hand — server 2636/2639 (the 3 are :3000), client
1131/1131.

server/openapi-extra/auth.js

@@ -49,6 +49,35 @@ const err = (description) => ({
   content: { "application/json": { schema: { $ref: "#/components/schemas/ErrorResponse" } } },
 });
 
+// The Users page's account changes: every body carries the admin's own
+// password again (`currentPassword`).
+const userBody = {
+  "application/json": {
+    schema: { type: "object", properties: { user: { $ref: "#/components/schemas/AuthUser" } } },
+  },
+};
+const idParam = { name: "id", in: "path", required: true, schema: { type: "integer" } };
+const changeBody = (properties, required = []) => ({
+  required: true,
+  content: {
+    "application/json": {
+      schema: {
+        type: "object",
+        required: [...required, "currentPassword"],
+        properties: { ...properties, currentPassword: { type: "string" } },
+      },
+    },
+  },
+});
+const changeResponses = {
+  200: { description: "Changed", content: userBody },
+  400: err("EBADPASSWORD / EBADROLE / EBADFIELD"),
+  403: err("EREAUTH (own password wrong) / EREADONLY / EADMIN / ELOCALMODE"),
+  404: err("ENOUSER / ENOLANE"),
+  409: err("ESELF — your own role or disable"),
+  429: err("ETOOMANY — 10 wrong passwords in 15 minutes"),
+};
+
 const paths = {
   "/api/users": {
     get: {
@@ -95,6 +124,70 @@ const paths = {
         403: err("EADMIN — a member"),
       },
     },
+    post: {
+      tags: ["Auth"],
+      operationId: "createServerUser",
+      summary:
+        "Admin: add an account. Needs the admin's own password again (currentPassword); audited",
+      requestBody: {
+        required: true,
+        content: {
+          "application/json": {
+            schema: {
+              type: "object",
+              required: ["username", "password", "currentPassword"],
+              properties: {
+                username: { type: "string" },
+                password: { type: "string", minLength: 8 },
+                role: { type: "string", enum: ["admin", "analyst", "member"], default: "member" },
+                currentPassword: { type: "string" },
+              },
+            },
+          },
+        },
+      },
+      responses: {
+        201: { description: "Created", content: userBody },
+        400: err("EBADUSER / EBADPASSWORD / EBADROLE"),
+        403: err("EREAUTH (own password wrong) / EREADONLY / EADMIN / ELOCALMODE"),
+        409: err("EEXISTS"),
+        429: err("ETOOMANY — 10 wrong passwords in 15 minutes"),
+      },
+    },
+  },
+  "/api/users/{id}": {
+    patch: {
+      tags: ["Auth"],
+      operationId: "updateServerUser",
+      summary:
+        "Admin: change a role and/or disable (ending every login) or enable. Never your own (ESELF)",
+      parameters: [idParam],
+      requestBody: changeBody({
+        role: { type: "string", enum: ["admin", "analyst", "member"] },
+        disabled: { type: "boolean" },
+      }),
+      responses: changeResponses,
+    },
+  },
+  "/api/users/{id}/password": {
+    post: {
+      tags: ["Auth"],
+      operationId: "resetServerUserPassword",
+      summary: "Admin: a new password for that user; every login of theirs ends",
+      parameters: [idParam],
+      requestBody: changeBody({ password: { type: "string", minLength: 8 } }, ["password"]),
+      responses: changeResponses,
+    },
+  },
+  "/api/users/{id}/workspaces": {
+    post: {
+      tags: ["Auth"],
+      operationId: "assignServerUserWorkspace",
+      summary: "Admin: make that user the owner of a workspace (lane)",
+      parameters: [idParam],
+      requestBody: changeBody({ laneId: { type: "integer" } }, ["laneId"]),
+      responses: changeResponses,
+    },
   },
   "/api/users/audit": {
     get: {