feat(server-s3): a member's tmux follows tmux upgrades — tmux-member + Users → Members' tmux

A member's tmux server keeps the version it started with until their last
pane closes, but the dashboard asked it with TMUX_BIN, the newest tmux: a
3.8 client on a 3.6 server spun it at 100% CPU (three members needed a
manual kill on 2026-10-15).

- /opt/agenthub/libexec/tmux-member (install-system, in sudoers): runs a
  member's tmux call with the binary of THEIR running server
  (/proc/<pid>/exe, found from the socket in /proc/net/unix), else
  TMUX_BIN. It runs as the member and execs only a process they own.
  sudoArgv uses it once installed (linux-accounts readConf), TMUX_BIN
  until then.
- Users → Members' tmux (GET /api/users/tmux): each member server's version
  beside the installed one, sessions, agents working. An admin restarts one
  (POST /api/users/:id/tmux-restart) or every idle outdated one
  (POST /api/users/tmux-restart-idle), with their password again, audited
  per member; a server that will not stop answers 409 ETMUXSTUCK naming
  its pid for root.
- server-s3-system.test.js: `delete` is a provision action since Delete
  user, so the "unknown action" case now uses `purge`.

Operators: run `sudo agenthub server install-system` once.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

client/src/lib/api.ts

@@ -544,6 +544,31 @@ export type ServerUserUsage = AuthUser & {
   logins?: number;
   lastLoginAt?: string | null;
 };
+/** One member's own tmux server (`GET /api/users/tmux`). */
+export interface MemberTmuxRow {
+  id: number;
+  username: string;
+  running: boolean;
+  /** Did not answer (hung, or backed off). */
+  stuck?: boolean;
+  version?: string | null;
+  pid?: number | null;
+  startedAt?: number | null;
+  sessions?: number | null;
+  /** Workspaces of theirs with an agent working now. */
+  busy: number;
+  /** Runs an older tmux than the installed one. */
+  outdated: boolean;
+}
+/** `GET /api/users/tmux`: `available` only with one Linux user per account. */
+export interface MemberTmux {
+  available: boolean;
+  installed?: string | null;
+  /** Calls on an older server already use its own binary (tmux-member installed). */
+  matched?: boolean;
+  users: MemberTmuxRow[];
+}
+
 /** One user's home folder on disk (`GET /api/users/storage`); null = not measured. */
 export type UserStorage = {
   bytes: number;
@@ -915,6 +940,24 @@ export const api = {
         method: "POST",
         body: JSON.stringify({ ...body, currentPassword }),
       }),
+    /** GET /api/users/tmux — each member's own tmux server beside the installed version (S3). */
+    tmux: () => request<MemberTmux>("/users/tmux"),
+    /** POST /api/users/:id/tmux-restart — end that member's tmux server (every pane of theirs). */
+    tmuxRestart: (id: number, currentPassword: string) =>
+      request<{ user: AuthUser }>(`/users/${id}/tmux-restart`, {
+        method: "POST",
+        body: JSON.stringify({ currentPassword }),
+      }),
+    /** POST /api/users/tmux-restart-idle — restart every outdated member server with no agent working. */
+    tmuxRestartIdle: (currentPassword: string) =>
+      request<{
+        restarted: string[];
+        skipped: string[];
+        failed: { username: string; message: string }[];
+      }>("/users/tmux-restart-idle", {
+        method: "POST",
+        body: JSON.stringify({ currentPassword }),
+      }),
     /** GET /api/users/:id — one account and the workspaces it owns (admin/analyst). */
     get: (id: number) => request<UserDetail>(`/users/${id}`),
     /** PATCH /api/users/:id — profile, role, state, password, workspaces and