--online turns the single-user daemon into an identity-keyed
multi-account host while leaving local and managed byte-identical
(the legacy serve_one is preserved under cfg(test) to prove it):
- TenantRegistry maps verified user ids to per-tenant WebCanvasState +
SseHub; leases are taken under the registry lock so a live
connection can never race eviction, and eviction compare-and-removes
with the M4 persistence seam marked in place
- ServeMode routes through 11 const predicates, all true for
local/managed; online locks down file IO, device-login proxy,
settings persistence, indicators, the POST / alias, generic
shutdown, sync-reset (safe no-op), LAN/relay collab actions (SSRF
surface), and the process-global thumbnail registry
- credentials arrive as Bearer or cookie via new HttpRequest capture;
IdentityVerifier starts with a static env-mapped verifier (hub
introspection lands in M2); missing verifier fails closed with 503
- /api/ai/* routes moved verbatim to connection_ai_routes.rs to keep
connection.rs under the file cap
a9149047ec