remove the dead multi-user surface

Officer is single-user: the server owner is the only account, created once by
/auth/bootstrap. Everything that existed to serve additional users was
unreachable, so it is gone rather than left looking like it does something.

Accounts: drop the invite / resend-invite / delete / list-users routes and the
Users settings screen, the inert /auth/signup handler, and the account
verification chain it fed (verify, resend-verification, VerifyScreen, the
UserInvite + VerifyAdmin + VerifyRegistration templates). /auth/verify-token
survives for password resets only, and now requires a reset-password token
rather than accepting any signed JWT.

Roles: drop the users.role column and the four-value USER_ROLES enum. The
permissions table granted every role identical methods, and every
role === 'Super Admin' check was permanently true. The JWT no longer carries a
role claim.

Sandbox: remove sidecar/sandbox.ts and its five call sites. bwrap was selected
only for non-Super-Admin users, so it never ran. It was also not a usable agent
jail as written — --share-net, the project root (with .env) bound read-only,
and runuser dropping to the server's own uid. Rebuilding it for agent
containment would be a different construction, and git history keeps this one.

getHomeDir keeps its DATA_PATH meaning; the new getOwnerHomeDir resolves the
owner's real login home, which is what terminals, chats and task runs use.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/api/integrations/integrations.ts

@@ -34,7 +34,7 @@ integrationsRouter.get('/', async (ctx) => {
   return ctx.json([]);
 });
 
-// --- Enterprise: Apify config (Super Admin only) ---
+// --- Apify config ---
 
 type ApifyConfig = { apiToken: string };
 
@@ -47,15 +47,10 @@ export const readApifyConfig = async (): Promise<ApifyConfig | null> => {
 };
 
 integrationsRouter.get('/apify/config', async (ctx) => {
-  const user = ctx.get('user');
-  if (user.role !== 'Super Admin') throw FORBIDDEN();
   return ctx.json(await readApifyConfig());
 });
 
 integrationsRouter.put('/apify/config', async (ctx) => {
-  const user = ctx.get('user');
-  if (user.role !== 'Super Admin') throw FORBIDDEN();
-
   const body = ctx.get('body') as { apiToken?: string };
   const config = { apiToken: body.apiToken ?? '' };
 
@@ -68,18 +63,13 @@ integrationsRouter.get('/apify/status', async (ctx) => {
   return ctx.json({ configured: !!config?.apiToken });
 });
 
-// --- Enterprise: Google OAuth config (Super Admin only) ---
+// --- Google OAuth config ---
 
 integrationsRouter.get('/google/config', async (ctx) => {
-  const user = ctx.get('user');
-  if (user.role !== 'Super Admin') throw FORBIDDEN();
   return ctx.json(await readGoogleConfig());
 });
 
 integrationsRouter.put('/google/config', async (ctx) => {
-  const user = ctx.get('user');
-  if (user.role !== 'Super Admin') throw FORBIDDEN();
-
   const body = ctx.get('body') as { clientId?: string; clientSecret?: string };
   const config = { clientId: body.clientId ?? '', clientSecret: body.clientSecret ?? '' };
 
@@ -88,9 +78,6 @@ integrationsRouter.put('/google/config', async (ctx) => {
 });
 
 integrationsRouter.get('/google/verify', async (ctx) => {
-  const user = ctx.get('user');
-  if (user.role !== 'Super Admin') throw FORBIDDEN();
-
   const config = await readGoogleConfig();
   if (!config?.clientId || !config?.clientSecret) {
     return ctx.json({ valid: false, error: 'Missing credentials' });
@@ -197,7 +184,11 @@ integrationsRouter.post('/google/gmail-proxy', async (ctx) => {
   const upstream = await fetch(url, init);
   const text = await upstream.text();
   let parsed: unknown;
-  try { parsed = JSON.parse(text); } catch { parsed = text; }
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    parsed = text;
+  }
 
   return ctx.json({ status: upstream.status, ok: upstream.ok, body: parsed });
 });