Add tasks: the crew's shared to-do list

Bots and workspaces each keep a list of work tracked until it's done, and
the bots move it along themselves as they work.

- tasks (one collection per bot or per workspace), task_notes (the
  progress log) and task_media (a deliverable or a reference file, its
  bytes a private media row served at /media/private/<id>)
- statuses todo/doing/blocked/done/cancelled, with blocked_reason while
  only the user can unblock it
- visibility as SQL in src/utils/task-access: a user's own bots and
  workspaces, a run's own list plus its workspaces, everything for the
  coordinator; every tool and endpoint resolves through it
- list_tasks, create_task and update_task on every run, so a chat reply,
  a task and a routine all read the list, log progress and file what they
  produced
- TasksNote on every run and TaskReminderNote in chat, so a greeting or a
  proposed next step brings pending work up in one measured line
- tasks group on the workspace dashboard and a tasks modal in the
  conversation header, sharing one form, row and detail panel
- a bot's or workspace's own chat uploads are read before the delete so
  none are stranded; bot files keep their folder

Also corrects the README's RAM guidance and table alignment.

src/functions/backend/db/tasks/purge-task-media.ts

@@ -0,0 +1,34 @@
+import BunSQLite from "@moduletrace/bun-sqlite";
+import type { BUN_SQLITE_COBBLE_TASK_MEDIA } from "@/db/types/db";
+
+type Params = {
+    /**
+     * A bot's own tasks, or a workspace's.
+     */
+    bot_id?: number | string | null;
+    workspace_id?: number | string | null;
+};
+
+/**
+ * The bytes a bot's or workspace's tasks filed that no folder owns (a chat
+ * upload linked to a task). Read before the bot or workspace is deleted:
+ * the tasks and their links cascade, and nothing else would ever clean
+ * those files up. A bot file is left alone: its folder is its home.
+ */
+export async function grabTaskMediaIds({ bot_id, workspace_id }: Params): Promise<number[]> {
+    const column = workspace_id ? "workspace_id" : "bot_id";
+    const owner = workspace_id || bot_id;
+
+    if (!owner) return [];
+
+    const links = (
+        await BunSQLite.sql<BUN_SQLITE_COBBLE_TASK_MEDIA>({
+            sql: `SELECT tm.media_id FROM task_media tm
+                JOIN tasks t ON t.id = tm.task_id
+                WHERE t.${column} = ? AND tm.bot_file_id IS NULL`,
+            values: [Number(owner)],
+        })
+    ).payload || [];
+
+    return links.map((link) => Number(link.media_id)).filter(Boolean);
+}