feat: AI Router per session; Settings at the sidebar's foot; shipped tool icons

AI Router is a session's choice, not a workspace's:
- an AI Router select beside the model picker in the workspace home and a
  pane's run form (RouterPicker.tsx; hidden off Claude/Codex or with only
  Native; last pick remembered in agenthub.session.router)
- `router` on POST /api/lanes/:id/start and POST /api/run; Claude gets
  --settings=<data dir>/router-settings/<name>.json (0600, outranks project
  and user settings, key never in argv), Codex -p <name> + key via tmux -e
- dashboard_runs.router; a resume naming none goes back to it
- profile PATCH rewrites the session files, DELETE removes them
- gone: POST /api/lanes/:id/router/apply, LaneRouterRow, the Add-workspace
  router radio, the claude-/codex-home `routers` answers; clearLaneRouters
  takes the old keys out of each workspace's settings.local.json at start

Sidebar: Settings pinned to the foot, the collapse toggle beside it (stacked
on the rail) instead of in the brand's corner.

Icons: shipped SVG marks for claude, codex, openclaw and hermes (a
black/white pair swapped by theme) in client/public/ai-tools/, used by
AiToolIcon before the server's favicon.

server/lib/lanes.js

@@ -293,43 +293,6 @@ function updateLane(id, patch = {}) {
   return getLane(id);
 }
 
-/**
- * Record which AI Router profile a lane runs against. Deliberately its own
- * function rather than a `PATCHABLE` field: the router is also written into the
- * lane's config on disk (`server/lib/router-apply.js`), so the column may only
- * move together with that write — a bare PATCH would leave the row claiming a
- * router the lane's settings file has never heard of.
- *
- * @param {number} id - The lane id.
- * @param {string|null} profile - A profile name, or null/"native" for the
- *   vendor's own API.
- */
-function setRouterProfile(id, profile) {
-  const value = !profile || profile === "native" ? null : String(profile);
-  db.prepare("UPDATE lanes SET router_profile = ?, updated_at = ? WHERE id = ?").run(
-    value,
-    nowIso(),
-    id
-  );
-  return getLane(id);
-}
-
-/**
- * Every lane attached to one AI Router profile. Editing or deleting a profile
- * has to reach the lanes that copied it (`server/lib/router-apply.js`), and this
- * is how those lanes are found.
- *
- * @param {string} profile - A profile name. `native` matches nothing: it is
- *   stored as NULL, and a lane on the vendor's own API has nothing to update.
- */
-function lanesByRouter(profile) {
-  if (!profile || profile === "native") return [];
-  return db
-    .prepare("SELECT * FROM lanes WHERE router_profile = ? ORDER BY id ASC")
-    .all(String(profile))
-    .map(hydrate);
-}
-
 /**
  * Write provisioning-time facts that `PATCH /api/lanes/:id` must never reach:
  * `base_branch`, resolved after `git worktree add` succeeds, and the runtime
@@ -928,8 +891,6 @@ module.exports = {
   deleteLane,
   setStage,
   clearCodexPipelines,
-  setRouterProfile,
-  lanesByRouter,
   recordDetection,
   clearLane,
   recoverInterruptedProvisioning,