fix: v2.7.4 — a developer's System page carries no host or other-user path

- GET /api/settings/info for a developer: no DB path, no hooks file path,
  and no transcript-cache keys — those were EVERY user's transcript paths
  (their folders and session ids). GET /api/updates/status: no repo_root.
  Test: server-mode-leaks.
- Also in this release (earlier commits): a member's missing workspace
  folder is made as them at start; --allow-dangerously-skip-permissions only
  for an account that accepted the bypass warning or a bypass run.
Full suites: server 2889/2889, client 1250/1250, tsc -b.

server/routes/settings.js

@@ -35,7 +35,7 @@ const {
   importExportBundle,
   exportableRun,
 } = require("../lib/data-transfer");
-const { sessionWhere, bySessionWhere } = require("../lib/scope");
+const { sessionWhere, bySessionWhere, memberId } = require("../lib/scope");
 
 function getDbSize() {
   try {
@@ -127,15 +127,20 @@ router.get("/info", (req, res) => {
     h1: getCount(60 * 60 * 1000),
   };
 
+  // A developer (server mode) gets the numbers, never a path of the host's:
+  // the transcript cache is keyed by EVERY user's transcript path (their
+  // folders, their session ids), and the DB/settings paths are the host's.
+  const developer = memberId(req) != null;
+  const cache = transcriptCache.stats();
   res.json({
     db: {
-      path: DB_PATH,
+      path: developer ? null : DB_PATH,
       size: dbSize,
       counts,
       pragmas,
       load_stats,
     },
-    hooks: hookStatus,
+    hooks: developer ? { installed: hookStatus.installed } : hookStatus,
     server: {
       version: APP_VERSION,
       uptime: process.uptime(),
@@ -152,7 +157,7 @@ router.get("/info", (req, res) => {
       free_mem: os.freemem(),
       cpus: os.cpus().length,
     },
-    transcript_cache: transcriptCache.stats(),
+    transcript_cache: developer ? { ...cache, keys: undefined } : cache,
   });
 });