Add the harness, envs, per-bot models and chat attachments

- Harness: providers, model catalog synced hourly, automatic free picks,
  cooldowns, tool loop with context trimming, MCP computer tools
- Bots queue runs replies and tasks through the harness; jobs wait
  (attempt refunded) while every model is resting
- Envs: Settings > Environment, scoped general/workspace/computer,
  written to computers and redacted from tool output
- Models: Settings > Models, per-harness provider select defaulting to
  OpenRouter, and a models modal on each bot's chat (the coordinator's
  edits the defaults)
- Chat: thinking row while a reply runs, file attachments (upload,
  paste, drop) that replies read as images, audio and document text
- Fix media uploads failing after a user's first file, and private
  files being served from the public media path

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/utils/redact-secrets.test.ts

@@ -0,0 +1,31 @@
+import { describe, expect, test } from "bun:test";
+import redactSecrets from "./redact-secrets";
+
+describe("redactSecrets", () => {
+    test("replaces every occurrence with the key", () => {
+        expect(
+            redactSecrets({
+                text: "token=ghp_abc123 and again ghp_abc123",
+                secrets: [{ key: "GITHUB_TOKEN", value: "ghp_abc123" }],
+            }),
+        ).toBe("token=[GITHUB_TOKEN] and again [GITHUB_TOKEN]");
+    });
+
+    test("replaces longer values first", () => {
+        expect(
+            redactSecrets({
+                text: "secret-long",
+                secrets: [
+                    { key: "SHORT", value: "secret" },
+                    { key: "LONG", value: "secret-long" },
+                ],
+            }),
+        ).toBe("[LONG]");
+    });
+
+    test("leaves very short values alone", () => {
+        expect(
+            redactSecrets({ text: "a 1 b", secrets: [{ key: "PIN", value: "1" }] }),
+        ).toBe("a 1 b");
+    });
+});