Add bot graphics

Bots can now show a concept as a visual: create_graphic (with
update_graphic, read_graphic and list_graphics, on every run, no computer
needed) stores one HTML document in bot_graphics, per user like the
conversation, and the chat renders its [graphic:ID] ref as an inline card
sized to fit, with a large view and a page of its own (no rail).

Graphic HTML is treated as hostile: it is only served at /graphics/<id>
with a CSP sandbox allowing scripts under an origin of its own and no
network, loading only the vendored Chart.js and Mermaid from
/graphics-lib/. The document carries the app's theme vars and scrollbars,
reports its height to the thread, and a frame that navigates away is
closed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/types/index.ts

@@ -653,6 +653,21 @@ export type PersonalSecret = {
  * A secret a bot asked the user for (\`[secret-request:ID]\`), as its chip
  * and card show it. Never holds a value.
  */
+/**
+ * A bot graphic (`[graphic:ID]`) as its card and page name it. The HTML
+ * itself is only ever served at `/graphics/<id>`.
+ */
+export type BotGraphicView = {
+    id: number;
+    title: string;
+    version: number;
+    bot_id: number;
+    bot_name: string;
+    workspace_id: number | null;
+    session_id: number | null;
+    updated_at: number;
+};
+
 export type SecretRequestView = {
     id: number;
     key: string;
@@ -1869,6 +1884,10 @@ export type PagePropsType = {
      * ones), for the files modal and the chips that name one.
      */
     bot_files?: BotFileScopesPayload | null;
+    /**
+     * On a graphic's own page: the graphic (never its HTML).
+     */
+    graphic?: BotGraphicView | null;
     /**
      * Whether the open conversation's mic (transcription) and read-aloud
      * (speech) are turned on for the bot there.