fix(custom-model): address third pre-merge review (Ark0N)

Blocker 1: the loading banner hides itself ~200ms after it reopens.

- _showCenterStatus reuses one shared DOM node; dismiss() scheduled
  el.hidden = true 200ms later with nothing to cancel it. On the
  Claude path, switchingToast.dismiss() is followed by one same-
  origin request (5-30ms locally) before _watchLlamaSwapLoading opens
  the new banner -- well inside that window -- so the stale timer
  fired against the shared node and hid the fresh banner, leaving the
  whole model-load wait with no progress text, no log line and no
  reachable Cancel button.
- Fixed by parking the pending timeout on the element and clearing it
  at the top of _showCenterStatus. Added a regression test that
  reproduces the exact repro (open, dismiss, reopen 20ms later,
  advance past 200ms) alongside the existing Cancel-button DOM tests;
  confirmed it fails without the fix and passes with it.

Blocker 2: the swap-conflict warning named other users' sessions.

- Both affectedSessions scans (POST .../custom-model and quick-start)
  walked the whole session map with no ownership filter, so in multi-
  user mode a non-admin pointing their own session at a shared
  endpoint learned another user's session name and id -- which with
  autoNameSessions on is that user's own prompt.
- The swap is still blocked pending confirmation regardless of
  ownership (a foreign session is just as real a disruption); only
  which ones get NAMED back to the caller is scoped, via the
  already-imported canAccessOwned. Added a two-owner test to
  test/routes/session-custom-model.test.ts covering both the
  foreign-owner (blocked, not named) and same-owner (named) cases.

Smaller ride-along fixes:

- server.ts boot recovery now passes contextLength into
  applyCustomModelInjection, so CLAUDE_CODE_MAX_CONTEXT_TOKENS is
  correctly rebuilt into _envOverrides after a restart instead of
  surviving only because tmux retains the old setenv.
- pumpLlamaSwapLogTail's finally now deletes by IDENTITY, not just by
  key, so an aborted pump finishing after a newer entry was created
  for the same endpoint can no longer delete that newer entry and
  orphan its connection.
- docs/custom-model-endpoints.md now notes that clearing a custom
  model removes injected keys by name, including CLAUDE_CONFIG_DIR --
  so a session that also had CLAUDE_CONFIG_DIR set via envOverrides
  (the per-client-account case) silently falls back to the default
  account on clear.

Left for later, as flagged in the review itself: the quick-start
case-scaffolding/cancel ordering (real behavioural reordering across
a large handler, too risky to make without a live re-test), and
retiring runCustomModelEntry's mode === 'claude' branch behind a
launchStrategy registry field (explicitly deferred by the reviewer to
"the next one").

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ea59JhUmHBm1gRCsiYF33R

test/routes/session-custom-model.test.ts

@@ -33,9 +33,9 @@ const CLAUDE_ENDPOINT: CustomModelHost = {
   apiKey: 'k',
 };
 
-async function setup() {
+async function setup(ctxOptions?: Parameters<typeof createRouteTestHarness>[1]) {
   await writeCustomModelHosts(getDataDir(), [CLAUDE_ENDPOINT]);
-  return createRouteTestHarness(registerSessionRoutes);
+  return createRouteTestHarness(registerSessionRoutes, ctxOptions);
 }
 
 describe('POST /api/sessions/:id/custom-model', () => {
@@ -294,6 +294,68 @@ describe('POST /api/sessions/:id/custom-model', () => {
       expect(session.restartCli).not.toHaveBeenCalled();
     });
 
+    describe('multi-user: the confirm dialog must not name a session the caller cannot access', () => {
+      const saved: Record<string, string | undefined> = {};
+
+      beforeEach(() => {
+        saved.CODEMAN_MULTIUSER = process.env.CODEMAN_MULTIUSER;
+        process.env.CODEMAN_MULTIUSER = '1';
+      });
+
+      afterEach(() => {
+        if (saved.CODEMAN_MULTIUSER === undefined) delete process.env.CODEMAN_MULTIUSER;
+        else process.env.CODEMAN_MULTIUSER = saved.CODEMAN_MULTIUSER;
+      });
+
+      it("still blocks the swap pending confirmation, but omits a foreign owner's session from affectedSessions", async () => {
+        const { app, ctx } = await setup({ authUser: { username: 'bob', role: 'user' } });
+        const session = ctx.sessions.get('test-session-1')!;
+        session.mode = 'claude';
+        (session as unknown as { owner?: string }).owner = 'bob';
+        const other = createMockSession('other-session');
+        other.name = 'w2-otherbox';
+        other.customModel = { endpointId: 'ep1', modelId: 'llama3' };
+        (other as unknown as { owner?: string }).owner = 'alice';
+        ctx.sessions.set('other-session', other);
+        mockRunning([{ model: 'llama3', state: 'ready' }]);
+
+        const res = await app.inject({
+          method: 'POST',
+          url: '/api/sessions/test-session-1/custom-model',
+          payload: { endpointId: 'ep1', modelId: 'qwen3' },
+        });
+
+        const body = res.json();
+        // Still asks — a foreign session is just as real a disruption as an owned one.
+        expect(body.requiresConfirmation).toBe(true);
+        expect(body.currentlyLoadedModel).toBe('llama3');
+        // But bob never learns alice's session id or name.
+        expect(body.affectedSessions).toEqual([]);
+        expect(session.setCustomModel).not.toHaveBeenCalled();
+      });
+
+      it('names the affected session when the caller DOES own it', async () => {
+        const { app, ctx } = await setup({ authUser: { username: 'bob', role: 'user' } });
+        const session = ctx.sessions.get('test-session-1')!;
+        session.mode = 'claude';
+        (session as unknown as { owner?: string }).owner = 'bob';
+        const other = createMockSession('other-session');
+        other.name = 'w2-otherbox';
+        other.customModel = { endpointId: 'ep1', modelId: 'llama3' };
+        (other as unknown as { owner?: string }).owner = 'bob';
+        ctx.sessions.set('other-session', other);
+        mockRunning([{ model: 'llama3', state: 'ready' }]);
+
+        const res = await app.inject({
+          method: 'POST',
+          url: '/api/sessions/test-session-1/custom-model',
+          payload: { endpointId: 'ep1', modelId: 'qwen3' },
+        });
+
+        expect(res.json().affectedSessions).toEqual([{ id: 'other-session', name: 'w2-otherbox' }]);
+      });
+    });
+
     it('applies once confirmed, skipping the conflict check the second time', async () => {
       const { app, ctx } = await setup();
       const session = ctx.sessions.get('test-session-1')!;