feat: v2.6.0 — Chat UI composer (+ menu, project files, activity panel, permission mode, Stop), git on a workspace's extra folders (#70), long paste as a file (#68), S3 server mode (experimental)

Chat UI:
- Each Claude/Codex session keeps its own chat/terminal view; Settings only
  sets how new sessions open.
- Composer + menu: upload, project files and folders (#54, also dragged from
  the Files/Changes tree), context files, recent uploads, skills, plugins.
- Activity side panel (progress, outputs, files read, uploads, memory,
  skills, connectors) with a file preview; edited-file counts per turn.
- Permission-mode chip (Shift+Tab steps, read back from the pane:
  server/lib/pane-mode.js, GET|POST /api/run/:id/permission-mode).
- Stop (Esc) while the main agent works; the status is checked per agent
  (with session_id /api/agents ignores its status filter) and re-read every
  5 s while Stop shows.
- Dropped images shown in the conversation (GET /api/run/drop/:name, the
  requester's own drop dir), full-size viewer.
- A plain-text paste over 5,000 characters is attached as pasted-text.txt,
  so no prompt reaches tmux/argv limits (#68).

Changes panel: every /api/lanes/:id/git* route takes ?source=<lane_sources
id> (sourceFolder; ENOSOURCE otherwise) and a folder picker switches the
whole panel to a workspace's extra folder (#70).

Server mode S3 (one Linux user per account) — experimental, verified with
fake sudo plus a P6 managed-settings spike on a test account:
- member tmux listing runs in the background (cached, 15 s => unknown);
- transcript snapshot copy is async, chunked, temp file + rename;
- Express Layer patch only on Express 4;
- tmux capturePane/sendKey go to the member's own server.

Docs: the multi-user design moved in as docs/plans/server-mode/README.md
(the AgentHub-Server repo is gone); S3-PLAN P6 result; LANES/API/openapi.

docs/SERVER-MODE.md

@@ -113,7 +113,11 @@ check; the AI proxy page shows them only their personal profiles' Edit. An
 analyst's Workspace page and sidebar list only
 their own workspaces (`useWorkLanes`); other users' work is read on Sessions,
 Analytics and Users, where Resume, Fork, Snapshot and "Open in workspace" are
-hidden for a session that is not theirs. An analyst's alert feed
+hidden for a session that is not theirs. The sidebar's workspace list shows an
+admin or analyst EVERY workspace, grouped under its owner (each lane carries
+`owner_name`; yours first, no owner last, each group folds): for an analyst
+another user's workspace there is read only — no menu, rename or new session,
+no live tabs, and a session opens its analysis page (`/sessions/<id>`). An analyst's alert feed
 (`GET /api/alerts`) carries `can_ack` on each alert — true only for their own
 sessions' — and the feed offers Acknowledge only there; Ack all acknowledges
 only theirs.
@@ -200,6 +204,9 @@ user makes the folder (it is the Linux account's home).
   under `/api` answers `401 EAUTH` until someone logs in, and the UI shows the
   login page. Paths are checked the way Express routes them: decoded, with
   repeated slashes collapsed, and case-insensitive.
+- The login page follows the OS's light/dark. After a login the dashboard
+  wears that account's own appearance (Settings → Appearance, saved in
+  `/api/me/prefs`); an account that never chose one follows the OS.
 - Hooks (`/api/hooks/*`) are accepted only from this machine: a loopback socket
   with no forwarding header. A request through the proxy gets
   `403 ELOCALONLY`. `POST /api/hooks/ingest-batch` keeps its own bearer token.