remove the dead multi-user surface

Officer is single-user: the server owner is the only account, created once by
/auth/bootstrap. Everything that existed to serve additional users was
unreachable, so it is gone rather than left looking like it does something.

Accounts: drop the invite / resend-invite / delete / list-users routes and the
Users settings screen, the inert /auth/signup handler, and the account
verification chain it fed (verify, resend-verification, VerifyScreen, the
UserInvite + VerifyAdmin + VerifyRegistration templates). /auth/verify-token
survives for password resets only, and now requires a reset-password token
rather than accepting any signed JWT.

Roles: drop the users.role column and the four-value USER_ROLES enum. The
permissions table granted every role identical methods, and every
role === 'Super Admin' check was permanently true. The JWT no longer carries a
role claim.

Sandbox: remove sidecar/sandbox.ts and its five call sites. bwrap was selected
only for non-Super-Admin users, so it never ran. It was also not a usable agent
jail as written — --share-net, the project root (with .env) bound read-only,
and runuser dropping to the server's own uid. Rebuilding it for agent
containment would be a different construction, and git history keeps this one.

getHomeDir keeps its DATA_PATH meaning; the new getOwnerHomeDir resolves the
owner's real login home, which is what terminals, chats and task runs use.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/api/desktop/rest.ts

@@ -6,7 +6,7 @@ export const desktopRouter = createRouter();
 
 desktopRouter.get('/vnc-password', async (ctx) => {
   const user = ctx.get('user');
-  const password = await getVncPassword(user.email, user.role);
+  const password = await getVncPassword(user.email);
   if (!password) {
     return ctx.json({ error: 'VNC password not configured' }, 500);
   }

src/servers/api/desktop/vnc-config.ts

@@ -1,12 +1,10 @@
 import { join } from 'node:path';
-import { getHomeDirForRole } from '@@/data-path';
+import { getOwnerHomeDir } from '@@/data-path';
 
-function getVncDir(email: string, role: string | null): string {
-  return join(getHomeDirForRole(email, role), '.vnc');
-}
+const getVncDir = (email: string): string => join(getOwnerHomeDir(email), '.vnc');
 
-export async function getVncPassword(email: string, role: string | null): Promise<string | null> {
-  const file = Bun.file(join(getVncDir(email, role), 'password'));
+export async function getVncPassword(email: string): Promise<string | null> {
+  const file = Bun.file(join(getVncDir(email), 'password'));
   if (!(await file.exists())) return null;
   return (await file.text()).trim();
 }

src/servers/api/desktop/websocket.ts

@@ -2,7 +2,7 @@ import type { ServerWebSocket } from 'bun';
 import type { Socket } from 'bun';
 import * as sidecar from '@@/sidecar-registry';
 
-type WSData = { userId: number; email: string; username: string; role: string; sandboxed: boolean; sessionId?: string };
+type WSData = { userId: number; email: string; username: string; sessionId?: string };
 
 type VncSession = {
   tcpSocket: Socket<{ ws: ServerWebSocket<WSData> }> | null;
@@ -21,7 +21,6 @@ export const desktopWebsocket = {
       const result = await sidecar.startVnc({
         email: ws.data.email,
         username: ws.data.username,
-        role: ws.data.role,
       });
       port = result.port;
     } catch (err) {