Add tasks: the crew's shared to-do list

Bots and workspaces each keep a list of work tracked until it's done, and
the bots move it along themselves as they work.

- tasks (one collection per bot or per workspace), task_notes (the
  progress log) and task_media (a deliverable or a reference file, its
  bytes a private media row served at /media/private/<id>)
- statuses todo/doing/blocked/done/cancelled, with blocked_reason while
  only the user can unblock it
- visibility as SQL in src/utils/task-access: a user's own bots and
  workspaces, a run's own list plus its workspaces, everything for the
  coordinator; every tool and endpoint resolves through it
- list_tasks, create_task and update_task on every run, so a chat reply,
  a task and a routine all read the list, log progress and file what they
  produced
- TasksNote on every run and TaskReminderNote in chat, so a greeting or a
  proposed next step brings pending work up in one measured line
- tasks group on the workspace dashboard and a tasks modal in the
  conversation header, sharing one form, row and detail panel
- a bot's or workspace's own chat uploads are read before the delete so
  none are stranded; bot files keep their folder

Also corrects the README's RAM guidance and table alignment.

src/functions/server/media/handle-media-server.ts

@@ -6,6 +6,7 @@ import path from "node:path";
 import userAuth from "../../backend/auth/user-auth";
 import grabSharedPictureMedia from "@/src/functions/backend/db/access/grab-shared-picture-media";
 import grabBotFileMedia from "@/src/functions/backend/db/bot-files/grab-bot-file-media";
+import grabTaskMediaFile from "@/src/functions/backend/db/tasks/grab-task-media-file";
 
 const { DATA_DIR } = grabDirNames();
 
@@ -54,6 +55,7 @@ export default async function handleMediaServer({
             media_res.singleRes ||
             (media_id ? await grabSharedPictureMedia({ media_id, user_id: user.id! }) : null) ||
             (media_id ? await grabBotFileMedia({ media_id, user_id: user.id! }) : null) ||
+            (media_id ? await grabTaskMediaFile({ media_id, user_id: user.id! }) : null) ||
             undefined;
     } else {
         const media_res = await BunSQLite.select<