Add the harness, envs, per-bot models and chat attachments

- Harness: providers, model catalog synced hourly, automatic free picks,
  cooldowns, tool loop with context trimming, MCP computer tools
- Bots queue runs replies and tasks through the harness; jobs wait
  (attempt refunded) while every model is resting
- Envs: Settings > Environment, scoped general/workspace/computer,
  written to computers and redacted from tool output
- Models: Settings > Models, per-harness provider select defaulting to
  OpenRouter, and a models modal on each bot's chat (the coordinator's
  edits the defaults)
- Chat: thinking row while a reply runs, file attachments (upload,
  paste, drop) that replies read as images, audio and document text
- Fix media uploads failing after a user's first file, and private
  files being served from the public media path

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/functions/backend/db/users/media/media-data-to-array-buffer.ts

@@ -20,7 +20,7 @@ export default async function MediaDataToArrayBuffer(
     if (body instanceof ReadableStream) {
         return Bun.readableStreamToArrayBuffer(body);
     }
-    // Blob, BunFile, Request, Response — wrap in Response and use Bun's reader
+    // Blob, BunFile, Request, Response: wrap in Response and use Bun's reader
     return new Response(body as BodyInit)
         .bytes()
         .then((b) => b.buffer as ArrayBuffer);

src/functions/backend/db/users/media/upload-and-record-media.ts

@@ -230,7 +230,13 @@ export default async function uploadAndRecordMedia({
     const media_data: BUN_SQLITE_COBBLE_MEDIA = {
         ...media,
         user_id: Number(user.id),
-        is_primary: is_primary ? 1 : 0,
+        /**
+         * NULL, not 0, when not primary: the (user_id, is_primary) unique
+         * constraint only means one primary image per user, and SQLite
+         * lets NULLs repeat.
+         */
+        is_primary: is_primary ? 1 : (null as any),
+        is_private: is_private ? 1 : 0,
         media_write_path: media_write_path,
         media_thumbnail_write_path:
             media_type === "image" ? media_thumbnail_write_path : undefined,