Add the harness, envs, per-bot models and chat attachments

- Harness: providers, model catalog synced hourly, automatic free picks,
  cooldowns, tool loop with context trimming, MCP computer tools
- Bots queue runs replies and tasks through the harness; jobs wait
  (attempt refunded) while every model is resting
- Envs: Settings > Environment, scoped general/workspace/computer,
  written to computers and redacted from tool output
- Models: Settings > Models, per-harness provider select defaulting to
  OpenRouter, and a models modal on each bot's chat (the coordinator's
  edits the defaults)
- Chat: thinking row while a reply runs, file attachments (upload,
  paste, drop) that replies read as images, audio and document text
- Fix media uploads failing after a user's first file, and private
  files being served from the public media path

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/utils/redact-secrets.ts

@@ -0,0 +1,26 @@
+type Params = {
+    text: string;
+    /**
+     * Secret values by the key they're shown as.
+     */
+    secrets: { key: string; value: string }[];
+};
+
+/**
+ * Replaces every secret value in `text` with `[KEY]`, longest first so a
+ * value inside another is never half replaced. Values under 4 characters
+ * are left alone: too likely to match ordinary text.
+ */
+export default function redactSecrets({ text, secrets }: Params) {
+    const usable = secrets
+        .filter((secret) => secret.value.length >= 4)
+        .sort((a, b) => b.value.length - a.value.length);
+
+    let redacted = text;
+
+    for (const secret of usable) {
+        redacted = redacted.split(secret.value).join(`[${secret.key}]`);
+    }
+
+    return redacted;
+}