remove the dead multi-user surface

Officer is single-user: the server owner is the only account, created once by
/auth/bootstrap. Everything that existed to serve additional users was
unreachable, so it is gone rather than left looking like it does something.

Accounts: drop the invite / resend-invite / delete / list-users routes and the
Users settings screen, the inert /auth/signup handler, and the account
verification chain it fed (verify, resend-verification, VerifyScreen, the
UserInvite + VerifyAdmin + VerifyRegistration templates). /auth/verify-token
survives for password resets only, and now requires a reset-password token
rather than accepting any signed JWT.

Roles: drop the users.role column and the four-value USER_ROLES enum. The
permissions table granted every role identical methods, and every
role === 'Super Admin' check was permanently true. The JWT no longer carries a
role claim.

Sandbox: remove sidecar/sandbox.ts and its five call sites. bwrap was selected
only for non-Super-Admin users, so it never ran. It was also not a usable agent
jail as written — --share-net, the project root (with .env) bound read-only,
and runuser dropping to the server's own uid. Rebuilding it for agent
containment would be a different construction, and git history keeps this one.

getHomeDir keeps its DATA_PATH meaning; the new getOwnerHomeDir resolves the
owner's real login home, which is what terminals, chats and task runs use.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/apps/officer-web/App.tsx

@@ -7,7 +7,7 @@ import { useServerEnvironment } from 'state/useServerEnvironment';
 import { useInitialData } from '@/state/useInitialData';
 
 export function App() {
-  const { isLoading, isAuthenticated, user } = useAuth();
+  const { isLoading, isAuthenticated } = useAuth();
   const { onboardingComplete, plugins, isLoading: isServerSettingsLoading } = useServerSettings();
   useServerEnvironment();
   useInitialData();
@@ -20,7 +20,6 @@ export function App() {
         <Authentication.AuthenticationLayout>
           <Routes>
             <Route path="/" element={<Authentication.LandingPage />} />
-            <Route path="/auth/verify" element={<Authentication.VerifyScreen />} />
             <Route path="/auth/forgot-password" element={<Authentication.ForgotPassword />} />
             <Route path="/auth/reset-password" element={<Authentication.ResetPassword />} />
             <Route path="*" element={<Navigate to="/" replace />} />
@@ -40,14 +39,7 @@ export function App() {
             <Route path="/" element={<Dashboard.HomeScreen />} />
             <Route path="/settings/profile" element={<Dashboard.ProfileSettings />} />
             <Route path="/settings/ai" element={<Dashboard.AISettings />} />
-            <Route
-              path="/settings/system"
-              element={user?.role !== 'Member' ? <Dashboard.SystemSettings /> : <Navigate to="/" replace />}
-            />
-            <Route
-              path="/settings/users"
-              element={user?.role === 'Super Admin' ? <Dashboard.UserSettings /> : <Navigate to="/" replace />}
-            />
+            <Route path="/settings/system" element={<Dashboard.SystemSettings />} />
             <Route path="/settings/integrations" element={<Dashboard.IntegrationsSettings />} />
             <Route path="/settings/apps" element={<Dashboard.AppsSettings />} />
             <Route path="/chat" element={<Dashboard.SessionListPage />} />
@@ -72,10 +64,7 @@ export function App() {
             <Route path="/email/:emailId" element={<Dashboard.EmailScreen />} />
             <Route path="/browser" element={<Dashboard.BrowserScreen />} />
             <Route path="/terminal" element={<Dashboard.TerminalScreen />} />
-            <Route
-              path="/desktop"
-              element={user?.role === 'Super Admin' ? <Dashboard.DesktopScreen /> : <Navigate to="/" replace />}
-            />
+            <Route path="/desktop" element={<Dashboard.DesktopScreen />} />
             <Route path="/auth/signout" element={<Authentication.SignoutScreen />} />
             <Route path="*" element={<Navigate to="/" replace />} />
           </Routes>