Add bot graphics

Bots can now show a concept as a visual: create_graphic (with
update_graphic, read_graphic and list_graphics, on every run, no computer
needed) stores one HTML document in bot_graphics, per user like the
conversation, and the chat renders its [graphic:ID] ref as an inline card
sized to fit, with a large view and a page of its own (no rail).

Graphic HTML is treated as hostile: it is only served at /graphics/<id>
with a CSP sandbox allowing scripts under an origin of its own and no
network, loading only the vendored Chart.js and Mermaid from
/graphics-lib/. The document carries the app's theme vars and scrollbars,
reports its height to the thread, and a frame that navigates away is
closed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

public/sw.js

@@ -54,9 +54,9 @@ const ASSET_PATHS = ["/favicon.ico", "/favicon.png", "/apple-touch-icon.png"];
 
 /**
  * Never intercepted: live data, sockets, media bytes, proxied computers,
- * auth side effects, and the worker itself.
+ * bot graphics, auth side effects, and the worker itself.
  */
-const BYPASS_PREFIXES = ["/api/", "/ws", "/media", "/computers/"];
+const BYPASS_PREFIXES = ["/api/", "/ws", "/media", "/computers/", "/graphics/", "/graphics-lib/"];
 const BYPASS_PATHS = ["/sw.js", "/manifest.webmanifest", "/auth/logout", BUILD_INFO_URL];
 
 /**