remove the dead multi-user surface

Officer is single-user: the server owner is the only account, created once by
/auth/bootstrap. Everything that existed to serve additional users was
unreachable, so it is gone rather than left looking like it does something.

Accounts: drop the invite / resend-invite / delete / list-users routes and the
Users settings screen, the inert /auth/signup handler, and the account
verification chain it fed (verify, resend-verification, VerifyScreen, the
UserInvite + VerifyAdmin + VerifyRegistration templates). /auth/verify-token
survives for password resets only, and now requires a reset-password token
rather than accepting any signed JWT.

Roles: drop the users.role column and the four-value USER_ROLES enum. The
permissions table granted every role identical methods, and every
role === 'Super Admin' check was permanently true. The JWT no longer carries a
role claim.

Sandbox: remove sidecar/sandbox.ts and its five call sites. bwrap was selected
only for non-Super-Admin users, so it never ran. It was also not a usable agent
jail as written — --share-net, the project root (with .env) bound read-only,
and runuser dropping to the server's own uid. Rebuilding it for agent
containment would be a different construction, and git history keeps this one.

getHomeDir keeps its DATA_PATH meaning; the new getOwnerHomeDir resolves the
owner's real login home, which is what terminals, chats and task runs use.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/apps/officer-web/Screens/Dashboard/Settings/AISettings.tsx

@@ -104,12 +104,8 @@ const DropZone = ({ label, children, onDrop }: DropZoneProps) => {
 // --- My Models Section (per-user hidden models) ---
 
 function MyModelsSection() {
-  const { user } = useAuth();
   const { settings, saveSettings } = useSettings();
-  const allModels = useModels();
-  const policyModels = useVisibleModels();
-  const isAdmin = user?.role !== 'Member';
-  const visibleModels = isAdmin ? allModels : policyModels;
+  const visibleModels = useModels();
   const [activeProvider, setActiveProvider] = useUserState<string>('my-models-provider', '');
 
   const hiddenModels = settings.chat.hiddenModels ?? [];
@@ -411,12 +407,7 @@ function MemberModelsSection() {
 //   // ... full implementation for future use
 // }
 
-// --- Build groups based on role ---
-
 function useAISettingsGroups(): SettingsSectionGroup[] {
-  const { user } = useAuth();
-  const isAdmin = user?.role !== 'Member';
-
   return useMemo(() => {
     const modelsGroup: SettingsSectionGroup = {
       label: 'Models',
@@ -429,17 +420,13 @@ function useAISettingsGroups(): SettingsSectionGroup[] {
           description: 'Show or hide models for yourself',
           content: <MyModelsSection />,
         },
-        ...(isAdmin
-          ? [
-              {
-                key: 'member-models',
-                icon: Eye,
-                title: 'Member Models',
-                description: 'Enable or disable models for members',
-                content: <MemberModelsSection />,
-              },
-            ]
-          : []),
+        {
+          key: 'member-models',
+          icon: Eye,
+          title: 'Channel Models',
+          description: 'Models reachable from Telegram, WhatsApp and Discord',
+          content: <MemberModelsSection />,
+        },
       ],
     };
 
@@ -457,25 +444,22 @@ function useAISettingsGroups(): SettingsSectionGroup[] {
       ],
     };
 
-    if (isAdmin) {
-      const providersGroup: SettingsSectionGroup = {
-        label: 'Providers',
-        icon: Terminal,
-        sections: [
-          {
-            key: 'ai-harnesses',
-            icon: Terminal,
-            title: 'Providers',
-            description: 'Remote and local AI providers',
-            content: <AIHarnessesSection />,
-          },
-        ],
-      };
-      return [providersGroup, modelsGroup, defaultsGroup];
-    }
+    const providersGroup: SettingsSectionGroup = {
+      label: 'Providers',
+      icon: Terminal,
+      sections: [
+        {
+          key: 'ai-harnesses',
+          icon: Terminal,
+          title: 'Providers',
+          description: 'Remote and local AI providers',
+          content: <AIHarnessesSection />,
+        },
+      ],
+    };
 
-    return [modelsGroup, defaultsGroup];
-  }, [isAdmin]);
+    return [providersGroup, modelsGroup, defaultsGroup];
+  }, []);
 }
 
 const layout: LayoutNode = {