remove the dead multi-user surface

Officer is single-user: the server owner is the only account, created once by
/auth/bootstrap. Everything that existed to serve additional users was
unreachable, so it is gone rather than left looking like it does something.

Accounts: drop the invite / resend-invite / delete / list-users routes and the
Users settings screen, the inert /auth/signup handler, and the account
verification chain it fed (verify, resend-verification, VerifyScreen, the
UserInvite + VerifyAdmin + VerifyRegistration templates). /auth/verify-token
survives for password resets only, and now requires a reset-password token
rather than accepting any signed JWT.

Roles: drop the users.role column and the four-value USER_ROLES enum. The
permissions table granted every role identical methods, and every
role === 'Super Admin' check was permanently true. The JWT no longer carries a
role claim.

Sandbox: remove sidecar/sandbox.ts and its five call sites. bwrap was selected
only for non-Super-Admin users, so it never ran. It was also not a usable agent
jail as written — --share-net, the project root (with .env) bound read-only,
and runuser dropping to the server's own uid. Rebuilding it for agent
containment would be a different construction, and git history keeps this one.

getHomeDir keeps its DATA_PATH meaning; the new getOwnerHomeDir resolves the
owner's real login home, which is what terminals, chats and task runs use.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/api/tasks/pipeline-jobs-routes.ts

@@ -39,7 +39,12 @@ pipelineJobsRouter.get('/', async (c) => {
 // job. Returns { jobId, status }. This is the REST creation path the phone / unattended runs use.
 pipelineJobsRouter.post('/', async (c) => {
   const user = c.get('user');
-  const body = await c.req.json<{ taskDirName: string; inputs?: Record<string, string>; cwd?: string; action?: 'start' | 'queue' }>();
+  const body = await c.req.json<{
+    taskDirName: string;
+    inputs?: Record<string, string>;
+    cwd?: string;
+    action?: 'start' | 'queue';
+  }>();
   if (!body.taskDirName) throw errors.BAD_REQUEST('taskDirName is required');
 
   const task = await getTaskByDirName(body.taskDirName);
@@ -52,9 +57,7 @@ pipelineJobsRouter.post('/', async (c) => {
       userId: user.id,
       email: user.email,
       username: user.username ?? '',
-      role: user.role ?? '',
       mode,
-      sandboxed: (user.role ?? '') !== 'Super Admin',
       taskDirName: body.taskDirName,
       taskName: task.name,
       inputs: body.inputs ?? {},