Add workspaces, computers, bot memory and the bots queue

- Schema: workspaces (+ workspace_bots, workspace_computers), containers,
  computers, bot_computers, bots.memory, workspaces.system_prompt, and
  bots_queue as a bun-sqlite isQueue table
- Main computer (and its container record) ensured with the coordinator on
  signup, seed and /admin/bots; the coordinator's access to it is locked
- Effective computer access: direct grants plus workspace computers
- Full bot prompt: core instructions, workspace prompts, then memory;
  bots can rewrite their memory and system prompt
- Queue helpers on the native BunSQLite.queue API, plus a handler that
  heartbeats, serializes per computer, recovers after restarts, reports
  lost jobs, supports cancelling and pushes outcomes over the WebSocket
- Enable SQLite foreign keys at startup so schema cascades fire
- Prune finished jobs daily

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/dict/bot-dict.ts

@@ -49,7 +49,7 @@ export const BotKinds = [
 export type BotKind = (typeof BotKinds)[number]["value"];
 
 /**
- * Every workspace has exactly one coordinator, created with the account. It
+ * Every user has exactly one coordinator, created with the account. It
  * coordinates the crew and hands work to the other bots.
  */
 export const CoordinatorBotName = "Coordinator";

src/dict/bot-queue-dict.ts

@@ -0,0 +1,11 @@
+/**
+ * `last_error` of a job the user cancelled. Cancelled jobs are `failed`
+ * (bun-sqlite queues have no cancelled status) with this error.
+ */
+export const BotJobCancelledError = "Cancelled";
+
+/**
+ * `last_error` bun-sqlite sets when it releases a job whose handler went
+ * silent past the lock timeout on its last attempt.
+ */
+export const BotJobLockTimedOutError = "Lock timed out";

src/dict/computer-dict.ts

@@ -0,0 +1,72 @@
+/**
+ * A computer is an AIO sandbox running in its own docker container on the
+ * cobble network. The main computer is set up at install and recorded on
+ * signup; sandboxes are created later by the main container.
+ */
+export const ComputerKinds = [
+    {
+        title: "Main",
+        value: "main",
+    },
+    {
+        title: "Sandbox",
+        value: "sandbox",
+    },
+] as const;
+
+export type ComputerKind = (typeof ComputerKinds)[number]["value"];
+
+export const MainComputerName = "Main computer";
+
+/**
+ * Docker container state as reported by `docker inspect` (`State.Status`),
+ * plus `unknown` for a record that hasn't been inspected yet.
+ */
+export const ContainerStatuses = [
+    {
+        title: "Created",
+        value: "created",
+    },
+    {
+        title: "Running",
+        value: "running",
+    },
+    {
+        title: "Paused",
+        value: "paused",
+    },
+    {
+        title: "Restarting",
+        value: "restarting",
+    },
+    {
+        title: "Exited",
+        value: "exited",
+    },
+    {
+        title: "Removing",
+        value: "removing",
+    },
+    {
+        title: "Dead",
+        value: "dead",
+    },
+    {
+        title: "Unknown",
+        value: "unknown",
+    },
+] as const;
+
+export type ContainerStatus = (typeof ContainerStatuses)[number]["value"];
+
+/**
+ * What a recorded container is for. The main app container is never recorded.
+ */
+export const ContainerPurposes = [
+    {
+        title: "Computer",
+        value: "computer",
+    },
+] as const;
+
+export type ContainerPurpose = (typeof ContainerPurposes)[number]["value"];