remove the dead multi-user surface

Officer is single-user: the server owner is the only account, created once by
/auth/bootstrap. Everything that existed to serve additional users was
unreachable, so it is gone rather than left looking like it does something.

Accounts: drop the invite / resend-invite / delete / list-users routes and the
Users settings screen, the inert /auth/signup handler, and the account
verification chain it fed (verify, resend-verification, VerifyScreen, the
UserInvite + VerifyAdmin + VerifyRegistration templates). /auth/verify-token
survives for password resets only, and now requires a reset-password token
rather than accepting any signed JWT.

Roles: drop the users.role column and the four-value USER_ROLES enum. The
permissions table granted every role identical methods, and every
role === 'Super Admin' check was permanently true. The JWT no longer carries a
role claim.

Sandbox: remove sidecar/sandbox.ts and its five call sites. bwrap was selected
only for non-Super-Admin users, so it never ran. It was also not a usable agent
jail as written — --share-net, the project root (with .env) bound read-only,
and runuser dropping to the server's own uid. Rebuilding it for agent
containment would be a different construction, and git history keeps this one.

getHomeDir keeps its DATA_PATH meaning; the new getOwnerHomeDir resolves the
owner's real login home, which is what terminals, chats and task runs use.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/server.tsx

@@ -33,9 +33,7 @@ type WSData = {
   userId: number;
   email: string;
   username: string;
-  role: string;
   provider: 'terminal' | 'chat' | 'task-runner' | 'pipeline' | 'dev-server' | 'cliamp' | 'cliamp-audio' | 'desktop' | 'sidecar';
-  sandboxed: boolean;
   sessionId?: string;
   cwd?: string;
   command?: string;
@@ -220,14 +218,13 @@ async function upgradeWs(req: Request, server: any, provider: 'terminal' | 'chat
 
     const url = new URL(req.url);
     const sessionId = url.searchParams.get('sessionId') ?? undefined;
-    const sandboxed = user.role !== 'Super Admin';
     const cwd = url.searchParams.get('cwd') ?? undefined;
     const command = url.searchParams.get('command') ?? undefined;
     const cols = url.searchParams.get('cols') ? Number(url.searchParams.get('cols')) : undefined;
     const rows = url.searchParams.get('rows') ? Number(url.searchParams.get('rows')) : undefined;
     const files = url.searchParams.get('files') ?? undefined;
     const ok = server.upgrade(req, {
-      data: { userId: user.id, email: user.email, username: toShellUsername(user.username ?? '', user.email), role: user.role, provider, sandboxed, sessionId, cwd, command, cols, rows, files },
+      data: { userId: user.id, email: user.email, username: toShellUsername(user.username ?? '', user.email), provider, sessionId, cwd, command, cols, rows, files },
     });
     if (!ok) return new Response('Upgrade failed', { status: 500 });
   } catch {
@@ -254,9 +251,7 @@ function upgradeDevServerWs(req: Request, server: any) {
     data: {
       userId: 0,
       email: '',
-      role: '',
       provider: 'dev-server' as const,
-      sandboxed: false,
       devServerPort: entry.port,
       devServerSlug: proxyId,
       wsProxyPath,
@@ -286,7 +281,7 @@ const server = serve({
     },
     '/api/sidecar/register': (req: Request, server: any) => {
       const ok = server.upgrade(req, {
-        data: { provider: 'sidecar', userId: 0, email: '', username: '', role: '', sandboxed: false },
+        data: { provider: 'sidecar', userId: 0, email: '', username: '' },
       });
       if (!ok) return new Response('Upgrade failed', { status: 500 });
     },