retire the single-user claim from the docs it outlived

CLAUDE.md asserted "single-user is a hard invariant, not a stage" while
users held six rows and role_capabilities held grants. Every doc that
repeated it is corrected here, in prose and in the code comments that
carried the same claim.

The accurate statement is narrower: one owner who bypasses every check,
other accounts holding only what their role is granted, and a set of
capabilities — terminal, chat, files, tasks, items, desktop, browser — that
are structurally ungrantable because they execute as the owner's OS user.

TODO.md gains a Multi-user section for what the read turned up: no way to
create a second account, dashboards.id colliding across users, authorize.ts
untested, pty/vault/opencode taking no identity, Radicale still owner_only.

claude-sidecar-isolation.md's open question is answered rather than left
open — the per-email spawn model is dead weight, because chat is an
execution capability and no second account can ever reach it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/file-sync.md

@@ -117,7 +117,8 @@ worth serving both from one place.
 - **It is not backup.** Sync propagates deletions. A synced folder is not a backup of itself, and
   anyone who believes otherwise finds out at the worst moment. Versioning (Syncthing has several
   strategies) should be enabled and surfaced in the UI precisely so this is not confused.
-- **It is not sharing.** Single-user remains a hard platform invariant.
+- **It is not sharing.** Files is an `execution` capability — the owner's disk, never grantable — so
+  there is still nobody to share with, whatever the account list says since 2026-08-07.
 
 ---