Add the harness, envs, per-bot models and chat attachments

- Harness: providers, model catalog synced hourly, automatic free picks,
  cooldowns, tool loop with context trimming, MCP computer tools
- Bots queue runs replies and tasks through the harness; jobs wait
  (attempt refunded) while every model is resting
- Envs: Settings > Environment, scoped general/workspace/computer,
  written to computers and redacted from tool output
- Models: Settings > Models, per-harness provider select defaulting to
  OpenRouter, and a models modal on each bot's chat (the coordinator's
  edits the defaults)
- Chat: thinking row while a reply runs, file attachments (upload,
  paste, drop) that replies read as images, audio and document text
- Fix media uploads failing after a user's first file, and private
  files being served from the public media path

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/layouts/bots/(partials)/rail-settings-list.tsx

@@ -1,5 +1,8 @@
+import { useContext } from "react";
 import Divider from "@moduletrace/twui/layout/Divider";
 import { SettingsPages } from "@/src/dict/settings-pages-dict";
+import { AppContext } from "@/src/pages/__root";
+import isPassThroughUser from "@/src/utils/rbac/is-pass-through-user";
 import RailBackLink from "./rail-back-link";
 import RailSettingsLink from "./rail-settings-link";
 
@@ -8,16 +11,23 @@ type Props = {
 };
 
 /**
- * Settings mode of the rail: back to the bots, then the settings sub pages.
+ * Settings mode of the rail: back to the bots, then the settings sub pages
+ * (super admin pages only for super admins).
  */
 export default function RailSettingsList({ pathname }: Props) {
+    const { pageProps } = useContext(AppContext);
     const current = pathname?.replace(/\/$/, "");
+    const is_super_admin = isPassThroughUser({
+        user_types: pageProps?.user_types,
+    });
 
     return (
         <>
             <RailBackLink />
             <Divider className="shrink-0 mx-1 lg:mx-3 my-2 w-auto border-hairline dark:border-hairline" />
-            {SettingsPages.map((page) => (
+            {SettingsPages.filter(
+                (page) => is_super_admin || !page.super_admin_only,
+            ).map((page) => (
                 <RailSettingsLink
                     key={page.url}
                     {...page}