retire the single-user claim from the docs it outlived

CLAUDE.md asserted "single-user is a hard invariant, not a stage" while
users held six rows and role_capabilities held grants. Every doc that
repeated it is corrected here, in prose and in the code comments that
carried the same claim.

The accurate statement is narrower: one owner who bypasses every check,
other accounts holding only what their role is granted, and a set of
capabilities — terminal, chat, files, tasks, items, desktop, browser — that
are structurally ungrantable because they execute as the owner's OS user.

TODO.md gains a Multi-user section for what the read turned up: no way to
create a second account, dashboards.id colliding across users, authorize.ts
untested, pty/vault/opencode taking no identity, Radicale still owner_only.

claude-sidecar-isolation.md's open question is answered rather than left
open — the per-email spawn model is dead weight, because chat is an
execution capability and no second account can ever reach it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/api/users/users-router.ts

@@ -13,10 +13,11 @@ usersRouter.use(originMiddleware);
 // Self-update. Any signed-in account may change its own name, username and avatar.
 usersRouter.put('/', updateUserHandler);
 
-// Everything below manages OTHER accounts and is the owner's alone. The global backstop in
-// originScopeMiddleware already confines a non-owner token to /api/auth + /api/music, so a Member
-// cannot reach these at all; this gate is the explicit statement of intent and gives a clear 403
-// rather than relying on a rule written for a different purpose.
+// Everything below manages OTHER accounts and is the owner's alone. The global capability backstop in
+// originScopeMiddleware already refuses a non-owner here — `user-admin` is `kind: 'admin'`, so it is
+// not grantable — but that router-level rule cannot see the one exception beside it: `PUT /` is
+// declared `selfService` so every account can edit its own profile. This gate is what keeps that
+// exception from widening to the routes below it, and it is a second lock rather than a restatement.
 const ownerGate: MiddlewareHandler = async (ctx, next) => {
   if (!(await isSuperAdmin(ctx.get('user')))) throw errors.FORBIDDEN('User management is owner-only');
   return next();