Add the harness, envs, per-bot models and chat attachments

- Harness: providers, model catalog synced hourly, automatic free picks,
  cooldowns, tool loop with context trimming, MCP computer tools
- Bots queue runs replies and tasks through the harness; jobs wait
  (attempt refunded) while every model is resting
- Envs: Settings > Environment, scoped general/workspace/computer,
  written to computers and redacted from tool output
- Models: Settings > Models, per-harness provider select defaulting to
  OpenRouter, and a models modal on each bot's chat (the coordinator's
  edits the defaults)
- Chat: thinking row while a reply runs, file attachments (upload,
  paste, drop) that replies read as images, audio and document text
- Fix media uploads failing after a user's first file, and private
  files being served from the public media path

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/functions/backend/db/harness/grab-harness-providers.ts

@@ -0,0 +1,35 @@
+import BunSQLite from "@moduletrace/bun-sqlite";
+import type { BUN_SQLITE_COBBLE_HARNESS_PROVIDERS } from "@/db/types/db";
+
+type Params = {
+    provider_id?: number | string;
+    enabled_only?: boolean;
+};
+
+/**
+ * Provider rows, oldest first. They hold the encrypted key: server only,
+ * never hand them to the client as they are (`toPublicHarnessProvider`).
+ */
+export default async function grabHarnessProviders({
+    provider_id,
+    enabled_only,
+}: Params = {}) {
+    const where: string[] = [];
+    const values: (string | number)[] = [];
+
+    if (provider_id) {
+        where.push(`id = ?`);
+        values.push(provider_id);
+    }
+
+    if (enabled_only) {
+        where.push(`enabled = 1`);
+    }
+
+    const res = await BunSQLite.sql<BUN_SQLITE_COBBLE_HARNESS_PROVIDERS>({
+        sql: `SELECT * FROM harness_providers ${where.length ? `WHERE ${where.join(" AND ")}` : ""} ORDER BY id ASC`,
+        values,
+    });
+
+    return res.payload || [];
+}