Append install-wide instructions to every bot's prompt

Settings > General gains a prompt appendix the super admin sets once:
markdown every bot runs with, right after its own core instructions.

- The text lives in app_settings (bot_system_prompt_append, read through
  grabSystemPromptAppend, cached like every app setting), so it changes
  without a deploy and applies to every bot on the next run.
- composeBotPrompt takes an appendix and pushes it as
  # Install-wide instructions directly after system_prompt, before the
  workspace block and memory, so the bot's own more specific rules still
  win. grabBotPrompt feeds it in, so chat replies, tasks, scheduled runs
  and the coordinator all get it with no call site touched.
- api/admin/settings/system-prompt-append saves it (super admin only,
  capped at AppData.PromptMaxLength, empty clears it) and is audit
  logged under system.
- The section and its form are hidden from everyone but the super admin,
  save in place with a character count and no reload, and say what an
  empty text does.

src/utils/compose-bot-prompt.ts

@@ -11,6 +11,11 @@ type WorkspaceBotPrompt = {
 
 type Params = {
     system_prompt?: string | null;
+    /**
+     * The install-wide text every bot gets, right after its own core
+     * instructions (Settings > General).
+     */
+    appendix?: string | null;
     memory?: string | null;
     /**
      * What the bot remembers about the user it's working with.
@@ -28,14 +33,15 @@ type Params = {
 
 /**
  * The full prompt a bot runs with (markdown): its own core instructions,
- * then, in a workspace, the workspace's context and the bot's
- * instructions there, then its core memory, its memory about the user and
- * its memory in the workspace (said to be the bot's own notes, not the
- * workspace's context). Empty parts are left out; the workspace heading
- * always shows, so the bot knows where it is.
+ * then the install-wide appendix, then, in a workspace, the workspace's
+ * context and the bot's instructions there, then its core memory, its
+ * memory about the user and its memory in the workspace (said to be the
+ * bot's own notes, not the workspace's context). Empty parts are left out;
+ * the workspace heading always shows, so the bot knows where it is.
  */
 export default function composeBotPrompt({
     system_prompt,
+    appendix,
     memory,
     user_memory,
     workspace,
@@ -48,6 +54,10 @@ export default function composeBotPrompt({
         parts.push(system_prompt.trim());
     }
 
+    if (appendix?.trim()) {
+        parts.push(`# Install-wide instructions\n\n${appendix.trim()}`);
+    }
+
     if (workspace) {
         const context = [workspace.description?.trim(), workspace.system_prompt?.trim()].filter(
             Boolean,