fix(omp): clamp OMP_AUTH_BROKER_URL/TOKEN, correct the env-allowlist docs

The docs claimed omp "has no documented vendor-key namespace of its own"
and "the multi-user clamp has nothing to gate" for omp — both false. Per
omp's own docs/environment-variables.md, it reads ~40 provider keys from
env (pi's known 34-key problem in the same shape), and its own knobs are
mostly PI_* (already globally allowlisted): PI_CONFIG_DIR,
PI_CODING_AGENT_DIR, PI_CODING_AGENT_SESSION_DIR, PI_SUBPROCESS_CMD,
PI_SHELL_PREFIX. The first three also move the ~/.omp tree
omp-session-resolver.ts/omp-transcript.ts hardcode, silently degrading
pinning/history — a known gap shared with pi, documented but not fixed
here.

The OMP_* prefix this PR adds brings in OMP_AUTH_BROKER_URL/
OMP_AUTH_BROKER_TOKEN, where omp resolves credentials from — the same
shape DEEPSEEK_BASE_URL is already dropped for in
clampEnvOverridesForOwner(). Add both to OWNER_CLAMPED_ENV_KEYS so a
non-granted owner in multi-user mode can't redirect them, and correct the
false claims in CLAUDE.md, docs/omp-integration.md, and the stale
resolveOmpHome() comment. Also documents omp's default
tools.approvalMode: yolo, which was previously unstated.

test/omp-mode.test.ts

@@ -1,9 +1,10 @@
-import { describe, expect, it } from 'vitest';
+import { describe, expect, it, beforeEach, afterEach } from 'vitest';
 import { CreateSessionSchema, QuickStartSchema } from '../src/web/schemas.js';
 import { buildSpawnCommand } from '../src/tmux-manager.js';
 import { defaultDockerCommandForMode } from '../src/docker-hosts.js';
 import { defaultRemoteCommandForMode } from '../src/remote-hosts.js';
 import { isExternalCliMode, isAltScreenStripMode } from '../src/session.js';
+import { _clampEnvOverridesForOwner } from '../src/web/routes/session-routes.js';
 
 describe('OMP mode schemas', () => {
   it('accepts OMP session creation config', () => {
@@ -132,3 +133,33 @@ describe('OMP mode gates', () => {
     expect(defaultRemoteCommandForMode('omp')).toBe('exec "${SHELL:-/bin/sh}" -i -l -c \'omp\'');
   });
 });
+
+describe('OMP multi-user clamp: the env-var half', () => {
+  // Unlike DeepSeek, omp has no permission FLAG or CONFIG for the clamp to
+  // gate (buildOmpCommand() only ever emits --model/--resume/--continue), so
+  // the only privilege surface is the two credential-resolution env vars the
+  // OMP_* prefix admits.
+  const ORIGINAL = process.env.CODEMAN_MULTIUSER;
+  beforeEach(() => {
+    process.env.CODEMAN_MULTIUSER = '1';
+  });
+  afterEach(() => {
+    if (ORIGINAL === undefined) delete process.env.CODEMAN_MULTIUSER;
+    else process.env.CODEMAN_MULTIUSER = ORIGINAL;
+  });
+
+  it('strips OMP_AUTH_BROKER_URL and OMP_AUTH_BROKER_TOKEN, leaving unrelated overrides alone', async () => {
+    const out = await _clampEnvOverridesForOwner('nobody', {
+      OMP_AUTH_BROKER_URL: 'https://attacker.example/broker',
+      OMP_AUTH_BROKER_TOKEN: 'stolen-token',
+      OMP_PROFILE: 'default',
+    });
+    expect(out).toEqual({ OMP_PROFILE: 'default' });
+  });
+
+  it('is a no-op in single-user mode', async () => {
+    delete process.env.CODEMAN_MULTIUSER;
+    const input = { OMP_AUTH_BROKER_URL: 'https://attacker.example/broker' };
+    expect(await _clampEnvOverridesForOwner(undefined, input)).toBe(input);
+  });
+});