Add the harness, envs, per-bot models and chat attachments

- Harness: providers, model catalog synced hourly, automatic free picks,
  cooldowns, tool loop with context trimming, MCP computer tools
- Bots queue runs replies and tasks through the harness; jobs wait
  (attempt refunded) while every model is resting
- Envs: Settings > Environment, scoped general/workspace/computer,
  written to computers and redacted from tool output
- Models: Settings > Models, per-harness provider select defaulting to
  OpenRouter, and a models modal on each bot's chat (the coordinator's
  edits the defaults)
- Chat: thinking row while a reply runs, file attachments (upload,
  paste, drop) that replies read as images, audio and document text
- Fix media uploads failing after a user's first file, and private
  files being served from the public media path

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/dict/private-tables.ts

@@ -1,7 +1,13 @@
 import type { TableType } from "@/src/types";
 
 /**
- * Tables holding secrets (password hashes, pending login codes). They are
- * never reachable through the admin CRUD API, not even by super admins.
+ * Tables holding secrets (password hashes, pending login codes, model
+ * provider keys, envs). They are never reachable through the admin CRUD API, not
+ * even by super admins.
  */
-export const PrivateTables: TableType[] = ["user_passwords", "sso_login_codes"];
+export const PrivateTables: TableType[] = [
+    "user_passwords",
+    "sso_login_codes",
+    "harness_providers",
+    "envs",
+];