feat: v2.5.12 — plan and quota for every AI tool, Grok Build and Kimi Code, Quit AgentHub (#65)

Usage panel (status bar):
- every account shows its plan (Claude subscriptionType, Codex
  chatgpt_plan_type, Cursor membershipType, Grok subscriptionTier)
- new quota rows: Cursor CLI (cursor.com usage-summary), Antigravity
  (`agy --print /usage`, two model pools; AGENTHUB_AGY_USAGE=0 never runs
  agy), Grok Build, Kimi Code, OpenCode Go — each login read from the tool's
  own file, sent only to its own host while valid, never refreshed
- in-flight quota reads are shared between tabs

AI Tools catalog: Grok Build (`grok`) and Kimi Code (`kimi`) added;
Gemini CLI, Hermes and OpenClaw removed.

Also: Quit AgentHub (#65, `agenthub stop`), status-area icon, Add to Chat
on an editor selection, Settings in three groups, JetBrains-style Changes
panel (ticked files/hunks, ignore, blame, file history), terminal font.

--no-verify: :3000 is taken by another dev server (lane-detect tests);
both suites run by hand — server 2636/2639 (the 3 are :3000), client
1131/1131.

server/routes/users.js

@@ -5,15 +5,23 @@
  * `GET /` lists every account with its workspaces, sessions and $ spent in the
  * last 7 and 30 days (from `token_usage_hourly`, sessions owned through their
  * workspace — server/lib/scope.js); `GET /audit` the newest audit entries
- * (server/lib/audit.js). Read-only: accounts are managed from the host's shell.
+ * (server/lib/audit.js).
+ *
+ * The Users page's account changes — `POST /` (create), `PATCH /:id` (role,
+ * disabled), `POST /:id/password` (reset) and `POST /:id/workspaces` (give a
+ * workspace) — are an admin's only (`/users` is in ADMIN_WRITE_PREFIXES), each
+ * needs the admin's own password again (`currentPassword`, `confirmPassword`),
+ * an admin never demotes or disables themselves (ESELF), every change is
+ * audited, and in local mode — no login to check — they all refuse.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
 const { Router } = require("express");
 const { db, stmts } = require("../db");
-const { listUsers } = require("../lib/auth");
+const auth = require("../lib/auth");
+const { listUsers } = auth;
 const { sessionWhere } = require("../lib/scope");
-const { listAudit } = require("../lib/audit");
+const { listAudit, recordAccountChange } = require("../lib/audit");
 
 const router = Router();
 
@@ -26,6 +34,11 @@ const USAGE_COLS = [
   "web_search_requests",
   "web_fetch_requests",
   "code_execution_requests",
+  "long_input_tokens",
+  "long_output_tokens",
+  "long_cache_read_tokens",
+  "long_cache_write_tokens",
+  "long_cache_write_1h_tokens",
 ];
 
 /** $ and tokens a member's sessions spent since `sinceHour` (UTC `YYYY-MM-DDTHH`). */
@@ -70,4 +83,106 @@ router.get("/audit", (req, res) => {
   res.json({ entries: listAudit(req.query.limit) });
 });
 
+const STATUS = {
+  EBADUSER: 400,
+  EBADPASSWORD: 400,
+  EBADROLE: 400,
+  EBADFIELD: 400,
+  EREAUTH: 403,
+  ELOCALMODE: 403,
+  ENOUSER: 404,
+  ENOLANE: 404,
+  EEXISTS: 409,
+  ESELF: 409,
+  ETOOMANY: 429,
+};
+
+/**
+ * One account change: server mode only, the admin's password confirmed, the
+ * change made, then audited. `fn(target)` returns the audit text.
+ */
+function accountChange(handler) {
+  return async (req, res) => {
+    try {
+      if (!auth.isServerMode() || !req.user) {
+        throw Object.assign(new Error("accounts are managed in server mode only"), {
+          code: "ELOCALMODE",
+        });
+      }
+      const body = req.body && typeof req.body === "object" ? req.body : {};
+      await auth.confirmPassword(req.user, body.currentPassword);
+      const out = await handler(req, body);
+      recordAccountChange(req.user.id, out.user.id, req.method, out.action);
+      res.status(out.status || 200).json({ user: out.user });
+    } catch (err) {
+      const status = STATUS[err.code];
+      if (!status) return res.status(500).json({ error: { message: err.message } });
+      res.status(status).json({ error: { code: err.code, message: err.message } });
+    }
+  };
+}
+
+/** The account `:id` names (404 ENOUSER otherwise). */
+function target(req) {
+  const u = db.prepare("SELECT * FROM users WHERE id = ?").get(Number(req.params.id));
+  if (!u) throw Object.assign(new Error("no such user"), { code: "ENOUSER" });
+  return u;
+}
+
+router.post(
+  "/",
+  accountChange(async (_req, body) => {
+    const role = body.role === undefined ? "member" : body.role;
+    const user = await auth.createUser(body.username, body.password, role);
+    return { status: 201, user, action: `create ${user.username} (${user.role})` };
+  })
+);
+
+router.patch(
+  "/:id",
+  accountChange(async (req, body) => {
+    const u = target(req);
+    const self = u.id === req.user.id;
+    const done = [];
+    if (body.role !== undefined && body.role !== u.role) {
+      if (self)
+        throw Object.assign(new Error("you cannot change your own role"), { code: "ESELF" });
+      auth.setRole(u.username, body.role);
+      done.push(`role ${body.role}`);
+    }
+    if (body.disabled !== undefined) {
+      if (typeof body.disabled !== "boolean") {
+        throw Object.assign(new Error("disabled: true or false"), { code: "EBADFIELD" });
+      }
+      if (self && body.disabled) {
+        throw Object.assign(new Error("you cannot disable yourself"), { code: "ESELF" });
+      }
+      auth.setDisabled(u.username, body.disabled);
+      done.push(body.disabled ? "disable" : "enable");
+    }
+    return {
+      user: auth.publicUser(target(req)),
+      action: `${u.username}: ${done.join(", ") || "no change"}`,
+    };
+  })
+);
+
+router.post(
+  "/:id/password",
+  accountChange(async (req, body) => {
+    const u = target(req);
+    await auth.setPassword(u.username, body.password);
+    return { user: auth.publicUser(u), action: `${u.username}: password reset` };
+  })
+);
+
+router.post(
+  "/:id/workspaces",
+  accountChange(async (req, body) => {
+    const u = target(req);
+    auth.assignWorkspace(body.laneId, u.username);
+    return { user: auth.publicUser(u), action: `${u.username}: workspace ${Number(body.laneId)}` };
+  })
+);
+
 module.exports = router;