Add bot graphics

Bots can now show a concept as a visual: create_graphic (with
update_graphic, read_graphic and list_graphics, on every run, no computer
needed) stores one HTML document in bot_graphics, per user like the
conversation, and the chat renders its [graphic:ID] ref as an inline card
sized to fit, with a large view and a page of its own (no rail).

Graphic HTML is treated as hostile: it is only served at /graphics/<id>
with a CSP sandbox allowing scripts under an origin of its own and no
network, loading only the vendored Chart.js and Mermaid from
/graphics-lib/. The document carries the app's theme vars and scrollbars,
reports its height to the thread, and a frame that navigates away is
closed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/utils/export-message-text.ts

@@ -15,8 +15,8 @@ type Params = {
 /**
  * A message's markdown as it reads outside the app: its refs in words
  * (`[bot:3]` as `@Ada`, `[workspace:2]` as `#Launch`, `[computer:3]` as
- * "computer 3", a folder as its path, a secret by number only, never its
- * value) and its headings dropped by
+ * "computer 3", a folder as its path, a graphic and a secret by number only, never
+ * a secret's value) and its headings dropped by
  * `heading_offset`. Code blocks are left exactly as they are.
  */
 export default function exportMessageText({
@@ -85,6 +85,7 @@ function wordRefs({
         .replace(/\[hook-proposal:(\d+)\](?!\()/g, "hook proposal $1")
         .replace(/\[secret:(\d+)\](?!\()/g, "(secret $1, hidden)")
         .replace(/\[secret-request:(\d+)\](?!\()/g, "(secret request $1)")
+        .replace(/\[graphic:(\d+)\](?!\()/g, "(graphic $1)")
         .replace(/\[file:(\d+)\](?!\()/g, "file $1")
         .replace(/\[folder:[a-z]+:\d+:([^\]\n]+)\](?!\()/g, "`$1`")
         .replace(/\[folder:([a-z]+):(\d+)\](?!\()/g, "the $1 $2 folder");