Add the harness, envs, per-bot models and chat attachments

- Harness: providers, model catalog synced hourly, automatic free picks,
  cooldowns, tool loop with context trimming, MCP computer tools
- Bots queue runs replies and tasks through the harness; jobs wait
  (attempt refunded) while every model is resting
- Envs: Settings > Environment, scoped general/workspace/computer,
  written to computers and redacted from tool output
- Models: Settings > Models, per-harness provider select defaulting to
  OpenRouter, and a models modal on each bot's chat (the coordinator's
  edits the defaults)
- Chat: thinking row while a reply runs, file attachments (upload,
  paste, drop) that replies read as images, audio and document text
- Fix media uploads failing after a user's first file, and private
  files being served from the public media path

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/functions/backend/db/bots/grab-attachable-media.ts

@@ -0,0 +1,33 @@
+import BunSQLite from "@moduletrace/bun-sqlite";
+import type { BUN_SQLITE_COBBLE_MEDIA } from "@/db/types/db";
+import AppError from "@/src/utils/app-error";
+
+type Params = {
+    user_id: number;
+    media_ids: number[];
+};
+
+/**
+ * The session user's own uploaded files, in the given order. Throws when
+ * any isn't theirs (or no longer exists), so a message can't carry
+ * someone else's file.
+ */
+export default async function grabAttachableMedia({ user_id, media_ids }: Params) {
+    const ids = [...new Set(media_ids)];
+
+    if (!ids.length) return [];
+
+    const rows =
+        (
+            await BunSQLite.sql<BUN_SQLITE_COBBLE_MEDIA>({
+                sql: `SELECT * FROM media WHERE user_id = ? AND id IN (${ids.map(() => "?").join(", ")})`,
+                values: [user_id, ...ids],
+            })
+        ).payload || [];
+
+    if (rows.length != ids.length) {
+        throw new AppError(`One of the files is gone. Attach it again.`);
+    }
+
+    return ids.map((id) => rows.find((row) => row.id == id)!);
+}