Add workspaces, conversation sessions, app-managed computers and pictures

- Rail: Add icon with stacked form modals (bot, workspace, computer),
  coordinator, recent bots with "See all bots", Workspaces section, and
  a workspace mode listing only its crew
- Workspaces: page for context, bots (per-workspace instructions and
  memory), computers (default, link, unlink), models and delete;
  conversations scoped per bot per workspace
- Sessions: conversations split into searchable, reopenable sessions
  with carry-over summaries; sessions and new-session header icons
- Computers: created and provisioned over the docker socket, home dir
  kept at DATA_DIR/computers/<id> after delete; super admins only
- Models: workspace settings win over a bot's own, then the defaults
- Pictures for bots and workspaces; bots editable from the header
- Coordinator tools: update_workspace, set_bot_workspace_instructions

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/functions/backend/db/bot-sessions/grab-user-bot-session.ts

@@ -0,0 +1,23 @@
+import type { BUN_SQLITE_COBBLE_BOT_SESSIONS } from "@/db/types/db";
+import BunSQLite from "@moduletrace/bun-sqlite";
+
+type Params = {
+    session_id: number | string;
+    user_id: number | string;
+};
+
+/**
+ * A session only if its bot belongs to the given owner.
+ */
+export default async function grabUserBotSession({
+    session_id,
+    user_id,
+}: Params): Promise<BUN_SQLITE_COBBLE_BOT_SESSIONS | null> {
+    const res = await BunSQLite.sql<BUN_SQLITE_COBBLE_BOT_SESSIONS>({
+        sql: `SELECT s.* FROM bot_sessions s JOIN bots b ON b.id = s.bot_id
+            WHERE s.id = ? AND b.user_id = ? LIMIT 1`,
+        values: [session_id, user_id],
+    });
+
+    return res.payload?.[0] || null;
+}