Return the directories the tunnel's filesystem connector may read.

The dashboard stores these per-project under executor_config.filesystem_roots (Settings → Executor Config). The tunnel is tenant-scoped, so this unions the roots across all of the tenant's projects. An empty list means the client falls back to the user's home directory (current default behaviour). Best-effort: any DB error yields an empty list rather than failing the tunnel.

Also returns known_repo_paths — the union of executor_config.repo_path across all projects. The tunnel client uses these as implicitly-trusted roots for the silent path auto-add (item 3 of dynamic-fs-roots feature).

b970fe07 — additionally returns serena_repo_path (first non-empty executor_config.serena_repo_path across projects — Serena's default --project) and codebase_code_dirs (deduped union of executor_config.codebase_code_dirs — the code-intel slot's auto-index dirs). Both are fall-back-safe: the client applies them only when the corresponding CLI flag (--repo / --code-dir) is absent.