feat: AI Router per session; Settings at the sidebar's foot; shipped tool icons

AI Router is a session's choice, not a workspace's:
- an AI Router select beside the model picker in the workspace home and a
  pane's run form (RouterPicker.tsx; hidden off Claude/Codex or with only
  Native; last pick remembered in agenthub.session.router)
- `router` on POST /api/lanes/:id/start and POST /api/run; Claude gets
  --settings=<data dir>/router-settings/<name>.json (0600, outranks project
  and user settings, key never in argv), Codex -p <name> + key via tmux -e
- dashboard_runs.router; a resume naming none goes back to it
- profile PATCH rewrites the session files, DELETE removes them
- gone: POST /api/lanes/:id/router/apply, LaneRouterRow, the Add-workspace
  router radio, the claude-/codex-home `routers` answers; clearLaneRouters
  takes the old keys out of each workspace's settings.local.json at start

Sidebar: Settings pinned to the foot, the collapse toggle beside it (stacked
on the rail) instead of in the brand's corner.

Icons: shipped SVG marks for claude, codex, openclaw and hermes (a
black/white pair swapped by theme) in client/public/ai-tools/, used by
AiToolIcon before the server's favicon.

server/lib/dashboard-runs.js

@@ -32,11 +32,11 @@ const insertStmt = db.prepare(`
   INSERT OR REPLACE INTO dashboard_runs (
     id, session_id, mode, cwd, model, permission_mode, effort,
     resume_session_id, prompt_preview, status, exit_code, started_at, ended_at,
-    lane_id, tool, worktree
+    lane_id, tool, worktree, router
   ) VALUES (
     @id, @session_id, @mode, @cwd, @model, @permission_mode, @effort,
     @resume_session_id, @prompt_preview, @status, @exit_code, @started_at, @ended_at,
-    @lane_id, @tool, @worktree
+    @lane_id, @tool, @worktree, @router
   )
 `);
 
@@ -51,7 +51,7 @@ const updateStmt = db.prepare(`
 
 const RUN_COLUMNS = `id, session_id, mode, cwd, model, permission_mode, effort,
          resume_session_id, prompt_preview, status, exit_code,
-         started_at, ended_at, lane_id, tool, worktree`;
+         started_at, ended_at, lane_id, tool, worktree, router`;
 
 const listStmt = db.prepare(`
   SELECT ${RUN_COLUMNS}
@@ -115,6 +115,7 @@ function recordRun(handle) {
       lane_id: typeof handle.laneId === "number" ? handle.laneId : null,
       tool: typeof handle.tool === "string" && handle.tool ? handle.tool : "claude",
       worktree: handle.worktree ? 1 : 0,
+      router: handle.router || null,
     });
   } catch (err) {
     // Best-effort by design (a live run must never fail because sqlite did),
@@ -162,6 +163,24 @@ function getRun(id) {
   }
 }
 
+const sessionRouterStmt = db.prepare(`
+  SELECT router FROM dashboard_runs
+  WHERE session_id = @sessionId OR resume_session_id = @sessionId
+  ORDER BY started_at DESC LIMIT 1
+`);
+
+/**
+ * The AI Router the newest run holding `sessionId` started on (null = native,
+ * or no run known) — what a resume that names no router goes back to.
+ */
+function routerForSession(sessionId) {
+  try {
+    return sessionRouterStmt.get({ sessionId })?.router || null;
+  } catch {
+    return null;
+  }
+}
+
 const runningStmt = db.prepare(
   "SELECT id FROM dashboard_runs WHERE status IN ('running', 'spawning')"
 );
@@ -193,4 +212,4 @@ function reconcileOrphans(isAlive = () => false) {
   }
 }
 
-module.exports = { recordRun, patchRun, listRuns, getRun, reconcileOrphans };
+module.exports = { recordRun, patchRun, listRuns, getRun, reconcileOrphans, routerForSession };