remove the dead multi-user surface

Officer is single-user: the server owner is the only account, created once by
/auth/bootstrap. Everything that existed to serve additional users was
unreachable, so it is gone rather than left looking like it does something.

Accounts: drop the invite / resend-invite / delete / list-users routes and the
Users settings screen, the inert /auth/signup handler, and the account
verification chain it fed (verify, resend-verification, VerifyScreen, the
UserInvite + VerifyAdmin + VerifyRegistration templates). /auth/verify-token
survives for password resets only, and now requires a reset-password token
rather than accepting any signed JWT.

Roles: drop the users.role column and the four-value USER_ROLES enum. The
permissions table granted every role identical methods, and every
role === 'Super Admin' check was permanently true. The JWT no longer carries a
role claim.

Sandbox: remove sidecar/sandbox.ts and its five call sites. bwrap was selected
only for non-Super-Admin users, so it never ran. It was also not a usable agent
jail as written — --share-net, the project root (with .env) bound read-only,
and runuser dropping to the server's own uid. Rebuilding it for agent
containment would be a different construction, and git history keeps this one.

getHomeDir keeps its DATA_PATH meaning; the new getOwnerHomeDir resolves the
owner's real login home, which is what terminals, chats and task runs use.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/workspaces/hooks/src/useAuth/types.ts

@@ -1,9 +1,3 @@
-export type SignupUserForm = {
-  email?: string;
-  name?: string;
-  password?: string;
-};
-
 export type UpdateUserPayload = { name: string; username?: string; avatar: string };
 
 export type ResetPasswordPayload = { password: string; verificationCode: string };

src/workspaces/hooks/src/useAuth/useAuth.ts

@@ -15,7 +15,6 @@ export const useAuth = (props: UseAuthProps = {}) => {
   const apiClient = useClient(apiUrl);
   const passKeyManager = usePasskeys();
 
-
   const { isLoading } = useQuery<UserWithToken | null>({
     queryKey: ['CURRENT_USER'],
     refetchOnMount: false,
@@ -70,22 +69,10 @@ export const useAuth = (props: UseAuthProps = {}) => {
     localStorage.removeItem('CURRENT_USER');
   };
 
-  const signup = async (newUser: SignupUserForm) => {
-    return await authClient.post('/signup', newUser);
-  };
-
   const resetPassword = async (payload: ResetPasswordPayload) => {
     await authClient.post('/reset-password', payload);
   };
 
-  const verify = async (payload: VerifyPayload) => {
-    const data = await authClient.post('/verify', payload);
-    if (data.token) {
-      localStorage.setItem('BEARER_TOKEN', data.token);
-      queryClient.invalidateQueries({ queryKey: ['CURRENT_USER'] });
-    }
-  };
-
   const updateUser = async (payload: UpdateUserPayload) => {
     await apiClient.put('/users', payload);
     localStorage.removeItem('CURRENT_USER');
@@ -112,8 +99,6 @@ export const useAuth = (props: UseAuthProps = {}) => {
     refreshUser,
     signin,
     signout,
-    signup,
-    verify,
     resetPassword,
     updateUser,
     changePassword,
@@ -122,12 +107,6 @@ export const useAuth = (props: UseAuthProps = {}) => {
   };
 };
 
-export type SignupUserForm = {
-  email?: string;
-  name?: string;
-  password?: string;
-};
-
 export type UpdateUserPayload = {
   name: string;
   username?: string;
@@ -145,11 +124,4 @@ export type ChangePasswordPayload = {
   confirmPassword: string;
 };
 
-export type VerifyPayload = {
-  verificationCode: string;
-  name?: string;
-  password?: string;
-  confirmPassword?: string;
-};
-
 export type ForgotPasswordPayload = { email: string };