feat(admin): Administration page — Users tab + Server tab (hardware, per-user CPU/memory/home share)

/users becomes /admin (redirected), a tab shell over the existing Users view
and a new Server tab backed by GET /api/host (server/lib/host-stats.js):
hostname/OS/uptime, CPU and load, memory and swap, every real disk with
HDD/SSD, NVIDIA GPUs, and each user's live share from two /proc samples —
attributed by the member's Linux uid (S3) or, for host processes, by the
inherited AGENTHUB_LANE_ID's workspace owner. Read-only, staff-only (/host
in STAFF_ONLY_PREFIXES), comm names only. Members' tmux card moves to the
Server tab.

docs/SERVER-MODE.md

@@ -153,7 +153,21 @@ Workspaces made before server mode, or by the host account, have none.
   written to the audit log: `agenthub users audit`, or `GET /api/users/audit`.
 - `GET /api/users` (admin/analyst) lists every account with its workspaces,
   sessions, and the tokens and $ it used in the last 7 and 30 days — the
-  Users page in the sidebar shows it, with the audit log under it.
+  **Administration** page in the sidebar (`/admin`; the old `/users` link
+  redirects there) shows it on its **Users** tab, with the audit log under it.
+- `GET /api/host` (admin/analyst, `/host` is staff-only) is Administration's
+  **Server** tab: the machine's hostname, OS, uptime, CPU model, cores and
+  load, memory and swap, every real disk (HDD or SSD, how full; the one
+  holding the users' homes is marked), any NVIDIA GPU, and each user's live
+  share of it — CPU % of the whole machine (100 % = every core busy) and
+  resident memory over a 1 s `/proc` sample, a process count, the busiest
+  processes by their kernel name (never argv or env), and their home's size
+  as a share of the homes disk. A process counts for a user when it runs as
+  their Linux account (S3) or, for the host account, when it inherited a
+  workspace's `AGENTHUB_LANE_ID` — so without S3 a user's share is only what
+  runs in their workspaces' panes; the rest is **Host account** or
+  **System**. Read-only (`server/lib/host-stats.js`); Linux only for the
+  per-user part. The page re-reads every 5 s while shown.
 - `GET /api/users/storage` (admin/analyst) is the page's **Storage** column:
   how much disk each user's home takes (their Linux home under S3, their
   folder under `AGENTHUB_USERS_ROOT` otherwise; an admin with none reads
@@ -700,7 +714,7 @@ a pane really is. Each case below is refused or bounded, with a test in
   an older server. Until `agenthub server install-system` has installed
   it, calls use `TMUX_BIN` directly, as before. A member's server keeps its
   version until their last pane closes; the next start runs `TMUX_BIN`.
-- **Users → Members' tmux** (admin/analyst read, admin acts): each member's
+- **Administration → Server → Members' tmux** (admin/analyst read, admin acts): each member's
   running server with its version beside the installed one (an *older than
   installed* badge), its sessions and whether an agent of theirs is working.
   **Restart** ends one member's server — every pane of theirs closes, their
@@ -783,7 +797,7 @@ agenthub server install-system
 
 A member server that a newer tmux already reached before `tmux-member` was
 installed can stay wedged: every call on that socket — `tmux-member`'s too —
-prints `server exited unexpectedly`. If Users → Members' tmux shows it with
+prints `server exited unexpectedly`. If Administration → Server → Members' tmux shows it with
 no panes, stop that one server (its pid is the `ah-<name>` process running
 `tmux -S <USERS_ROOT>/<name>/.agenthub/tmux/sock`) with `sudo kill -9 <pid>`;
 the next start runs a fresh server on `TMUX_BIN`. Never `tmux kill-server`.