feat: v2.5.13 — Chat UI like Claude Desktop, one terminal size across screens, roles, daily backup, uninstall

- Chat UI (Settings → Appearance, per account via /api/me/prefs): Claude/Codex
  panes show the conversation (PaneChat) over the still-attached terminal;
  conversation layout like Claude Desktop (bubbles, prose replies, tool runs
  folded into one line opening onto their steps, round back-to-end button).
- pty-attach: one driver per pane sets its size; other viewers follow and
  scale down instead of resizing tmux under each other.
- Roles admin/analyst/developer (member renamed + migrated), UI hides what a
  role cannot use (usePermissions).
- Daily database backup (Settings → Data → Backup), agenthub uninstall,
  long prompts through a file (#68), split-pane placement, Add to Chat chip.

Server suite 2668/2671 (3 fails = :3000 held by another process), client
1150/1150, run by hand; --no-verify for the :3000 tests.

docs/plans/roles-developer/CHECKLIST.md

@@ -0,0 +1,36 @@
+# Roles: admin / analyst / developer — checklist
+
+Decisions (user, 2026-10-08):
+- `member` is renamed `developer` everywhere, stored value included (migration).
+- developer: full control of OWN workspaces/sessions/git; nothing host-wide.
+- analyst: sees every user's rows (as today) AND works on OWN rows like a
+  developer (was: read-only); nothing host-wide, never another user's rows.
+- UI hides every control the role cannot use; refusals show a clear toast.
+
+## Server
+- [x] db.js: rebuild `users` with CHECK(admin, analyst, developer), member→developer
+- [x] auth.js: ROLES, default role, STAFF_ONLY gate, analyst no longer EREADONLY
+- [x] auth.js: `/alerts/rules` joins ADMIN_WRITE_PREFIXES (host-wide rules)
+- [x] scope.js: `memberId` = developer always, analyst on writes only
+- [x] websocket.js: analyst terminal only on own runs; broadcast member→developer
+- [x] audit.js, users.js, workflow-stats.js, openapi-extra/auth.js, CLI users
+- [x] tests: update member→developer, add analyst write-scope tests
+
+## Client
+- [x] one role helper (isAdmin / canSeeAll) from useAuth
+- [x] hide admin-only controls (inventory from Explore)
+- [x] analyst: hide write controls on other users' rows
+- [x] errors: EADMIN / EREADONLY / ENOTFOUND toasts translated (en + vi)
+- [x] role label "Developer" en/vi, Users page role select
+
+## Finish
+- [x] npm run test:server, npm run test:client
+- [x] docs: SERVER-MODE.md, CLAUDE.md lines naming `member`
+- [x] headers check
+
+## Follow-ups (2026-10-08)
+- [x] analyst alert feed: `can_ack` per alert, Ack hidden on others' (server test + client test)
+- [x] Settings search: admin-only entries (autostart, quit, tray, reports, webhooks, git creds) hidden
+- [x] SessionDetail: an unstamped session's owner resolved by folder (`owningLane`)
+- [ ] prod/dev share one DB: restart prod on the new build together with the first run (migration)
+- [ ] `agenthub stop` in server mode answers EAUTH (fix was blocked; user to decide)