fix: v2.7.4 — a developer's System page carries no host or other-user path

- GET /api/settings/info for a developer: no DB path, no hooks file path,
  and no transcript-cache keys — those were EVERY user's transcript paths
  (their folders and session ids). GET /api/updates/status: no repo_root.
  Test: server-mode-leaks.
- Also in this release (earlier commits): a member's missing workspace
  folder is made as them at start; --allow-dangerously-skip-permissions only
  for an account that accepted the bypass warning or a bypass run.
Full suites: server 2889/2889, client 1250/1250, tsc -b.

server/routes/updates.js

@@ -24,9 +24,11 @@ const { schedulePluginUpdate } = require("../lib/plugin-update");
 
 const router = Router();
 
-router.get("/status", async (_req, res) => {
+router.get("/status", async (req, res) => {
   try {
     const status = await getUpdatesStatus();
+    // The install folder is the host's; a developer sees versions only.
+    if (require("../lib/scope").memberId(req) != null) status.repo_root = null;
     res.json(status);
   } catch (err) {
     res.status(500).json({