fix(multiuser): close cross-user web-layer scoping holes found in review

The opt-in multi-user feature's only enforcement is web-layer scoping
(all sessions share one OS account). An adversarial review found 8 critical
+ 7 high cross-user holes that defeated it, plus mediums; all fixed here.
Single-user (flag-off) behavior stays byte-identical apart from documented
consistency deltas.

Ownership / confinement:
- DELETE /api/sessions (bulk) + /:id now owner-scope / findSessionOrFail
- quick-start, cron (create+fire), scheduled runs confine workingDir to the
  owner's space; case link/docker-link/docker-import confine the host path
- resolveCasePath no longer resolves linked cases for non-admins; foreign
  remote/docker cases are skipped (fall through to the caller's own local case)
- history, subagents/workflows, mux-sessions, orchestrator, cron run-history,
  away-digest, and remote/docker host reads are owner- or admin-scoped

Permission policy (section 6.3):
- non-granted users are downgraded at every spawn site incl. legacy
  /api/scheduled, PlanOrchestrator one-shots, remote launch, and the cron-fire
  gemini/codex bypass switches; resolveClaudeModeForUsername now fails closed

Auth / store:
- verify-first login throttle (a correct password is never locked out),
  /ws terminal subject to the change-password lockbox, cookie fast-path
  re-validates identity live, role/grant changes revoke sessions, admin delete
  runs the last-admin guard before any teardown
- users.json: distinguish missing (ENOENT) from corrupt/unreadable so a bad
  read can't overwrite all accounts; unique per-process temp write path

Event streams:
- debounced session:updated + batched task:updated, clipboard, and push
  notifications route by owner (fail closed); getLightState hides machine-wide
  globalStats from non-admins

Tests: two suites updated to assert the fixed (secure) behavior. tsc, eslint,
and test:ci all green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/web/ports/auth-port.ts

@@ -13,9 +13,12 @@ export interface AuthSessionRecord {
   method: 'qr' | 'basic';
   /**
    * Multi-user identity carried by the cookie (single-user leaves these unset).
-   * Snapshotted at mint time; state transitions that would change them (password
-   * reset, disable, delete) revoke the user's sessions so a stale snapshot can't
-   * outlive the change. See docs/multi-user-plan.md section 5.
+   * Snapshotted at mint time. Authorization-relevant admin changes (password reset,
+   * disable, delete, role change, bypass-grant change) revoke the user's sessions so
+   * a stale snapshot can't outlive the change; additionally the cookie fast-path
+   * re-reads role/disabled/mustChangePassword live from the store each request, so an
+   * out-of-band CLI mutation also takes effect promptly. See docs/multi-user-plan.md
+   * section 5.
    */
   username?: string;
   role?: 'admin' | 'user';

src/web/ports/infra-port.ts

@@ -23,6 +23,9 @@ export interface ScheduledRun {
   completedTasks: number;
   totalCost: number;
   logs: string[];
+  /** Multi-user owner (username) — undefined in single-user mode. Used to scope
+   * list/delete and to downgrade the spawned Session's permission mode. */
+  owner?: string;
 }
 
 export interface InfraPort {
@@ -33,6 +36,6 @@ export interface InfraPort {
   readonly teamWatcher: TeamWatcher;
   readonly tunnelManager: TunnelManager;
   readonly pushStore: PushSubscriptionStore;
-  startScheduledRun(prompt: string, workingDir: string, durationMinutes: number): Promise<ScheduledRun>;
+  startScheduledRun(prompt: string, workingDir: string, durationMinutes: number, owner?: string): Promise<ScheduledRun>;
   stopScheduledRun(id: string): Promise<void>;
 }