feat: v2.7.7 — File Explorer on workspaces and the user's home, clone with per-user git identity

- File Explorer (Files in the sidebar, /files; also from a workspace's Files
  tab, portalled so no panel clips it), laid out like GNOME Files: places
  (Home, workspaces, Trash), Back/Forward/Up, path bar, search, icon grid with
  image thumbnails or list, labelled New/Upload, selection action bar, hidden
  files behind Ctrl+H, right-click menus and the usual keys.
  Make, rename, move, copy (within a workspace, between workspaces, home ↔
  workspace), delete into a per-account trash restorable for 7 days, streamed
  upload of files and whole folders (≤ 500 MB a batch, Replace / Keep both /
  Skip on a taken name), download a file or a zip of anything.
  server/lib/file-explorer.js, /api/lanes/:id/fs/*, /api/homes/:who/fs/*.
- The user's home: every dot entry at its top stays hidden and refused
  (also via a symlink, download, zip or as a copy source); an admin may view
  other users' homes read-only, audited.
- write-as learns move/copy (re-run `sudo agenthub server install-system`).
- Hardening: a write to a workspace re-checks its owner by the live role;
  S3 keeps its server.conf if the file stops reading and a tmux call never
  falls back to the host's server; the AI Proxy gateway marks what it relays
  and the dashboard refuses it; a NUL in a pane's argv/env is refused.
- OpenAPI for the new routes (server/openapi-extra/files.js); docs (API,
  SERVER-MODE, CLAUDE.md) updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/lib/audit.js

@@ -6,7 +6,8 @@
  * it, whose it was and which path. `auditGuard` runs on `/api` after the
  * scope guard; it never blocks a request, and it is a no-op in local mode and
  * for a member (who can only read their own). An admin's account change on
- * the Users page is written here too (`recordAccountChange`).
+ * the Users page is written here too (`recordAccountChange`), and so is an
+ * admin's look into another user's home (`recordHomeRead`, File Explorer).
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
@@ -68,4 +69,15 @@ function recordAccountChange(actorId, targetId, method, action) {
   ).run(actorId, targetId, method, String(action).slice(0, 500));
 }
 
-module.exports = { auditGuard, listAudit, recordAccountChange };
+/** An admin opening another user's home in the File Explorer (read-only). */
+function recordHomeRead(actorId, ownerId, method, what) {
+  try {
+    sql(
+      "INSERT INTO audit_log (user_id, owner_id, session_id, method, path) VALUES (?, ?, NULL, ?, ?)"
+    ).run(actorId, ownerId, method, String(what).slice(0, 500));
+  } catch (err) {
+    console.warn("[audit] could not record:", err.message);
+  }
+}
+
+module.exports = { auditGuard, listAudit, recordAccountChange, recordHomeRead };