remove the dead multi-user surface

Officer is single-user: the server owner is the only account, created once by
/auth/bootstrap. Everything that existed to serve additional users was
unreachable, so it is gone rather than left looking like it does something.

Accounts: drop the invite / resend-invite / delete / list-users routes and the
Users settings screen, the inert /auth/signup handler, and the account
verification chain it fed (verify, resend-verification, VerifyScreen, the
UserInvite + VerifyAdmin + VerifyRegistration templates). /auth/verify-token
survives for password resets only, and now requires a reset-password token
rather than accepting any signed JWT.

Roles: drop the users.role column and the four-value USER_ROLES enum. The
permissions table granted every role identical methods, and every
role === 'Super Admin' check was permanently true. The JWT no longer carries a
role claim.

Sandbox: remove sidecar/sandbox.ts and its five call sites. bwrap was selected
only for non-Super-Admin users, so it never ran. It was also not a usable agent
jail as written — --share-net, the project root (with .env) bound read-only,
and runuser dropping to the server's own uid. Rebuilding it for agent
containment would be a different construction, and git history keeps this one.

getHomeDir keeps its DATA_PATH meaning; the new getOwnerHomeDir resolves the
owner's real login home, which is what terminals, chats and task runs use.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/api/cliamp/websocket.ts

@@ -2,7 +2,7 @@ import type { ServerWebSocket } from 'bun';
 import { spawn, type Subprocess } from 'bun';
 import { resolve, normalize, dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { getHomeDirForRole } from '@@/data-path';
+import { getOwnerHomeDir } from '@@/data-path';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const ASOUNDRC_PATH = join(__dirname, 'asoundrc');
@@ -11,7 +11,6 @@ type WSData = {
   userId: number;
   email: string;
   username: string;
-  role: string;
   files: string;
 };
 
@@ -59,7 +58,9 @@ const findCliamp = (): string | null => {
     try {
       const stat = Bun.spawnSync({ cmd: ['test', '-x', bin], stdout: 'ignore', stderr: 'ignore' });
       if (stat.exitCode === 0) return bin;
-    } catch { /* ignore */ }
+    } catch {
+      /* ignore */
+    }
   }
   return null;
 };
@@ -68,7 +69,7 @@ const shellEscape = (s: string) => `'${s.replace(/'/g, "'\\''")}'`;
 
 export const cliampWebsocket = {
   async open(ws: ServerWebSocket<WSData>) {
-    const { email, role, files: filesParam } = ws.data;
+    const { email, files: filesParam } = ws.data;
 
     if (!filesParam) {
       sendOutput(ws, '\r\n[Error] No files specified.\r\n');
@@ -81,7 +82,7 @@ export const cliampWebsocket = {
       return;
     }
 
-    const homeDir = getHomeDirForRole(email, role);
+    const homeDir = getOwnerHomeDir(email);
     const rawFiles = [filesParam];
 
     // Resolve paths relative to user home dir
@@ -187,7 +188,11 @@ export const cliampWebsocket = {
     const session = sessions.get(ws);
     if (session) {
       session.closed = true;
-      try { session.proc.kill(); } catch { /* ignore */ }
+      try {
+        session.proc.kill();
+      } catch {
+        /* ignore */
+      }
       sessions.delete(ws);
     }
   },