dashboard: POST /matrix-account-login + account-aware hive-priv matrix-token write (BE-2)

hive-priv/src/main.rs

@@ -242,9 +242,23 @@ async fn exec(req: PrivRequest, writer: &mut OwnedWriteHalf) -> Result<(String,
         PrivRequest::WriteAgentMatrixToken {
             ref agent_name,
             ref token,
+            ref account,
         } => {
             validate_agent_name(agent_name)?;
-            write_agent_state_file(agent_name, "matrix-token", &format!("{token}\n"))
+            // Build the token filename. `None` → the hive account's
+            // `matrix-token`; `Some(a)` → `matrix-token-<a>`. The account
+            // suffix MUST be validated as a plain identifier (no `/`, `.`,
+            // `..`) before it goes into the filename, or a crafted account
+            // could traverse out of the state dir — `write_agent_state_file`
+            // trusts its `filename` argument.
+            let filename = match account {
+                None => "matrix-token".to_owned(),
+                Some(a) => {
+                    validate_name_chars(a)?;
+                    format!("matrix-token-{a}")
+                }
+            };
+            write_agent_state_file(agent_name, &filename, &format!("{token}\n"))
         }
 
         PrivRequest::RestartMatrixDaemon { ref agent_name } => {