Share one crew across the install, keep user memory per user

Bots, workspaces and computers now belong to the install. Users reach
workers only through bot_users (assigned by a super admin or admin) and
workspace_users; the coordinator and main computer are one per install,
and only the super admin sees the coordinator. Conversations are per
user (bot_sessions.user_id), jobs run for the session's user, and live
updates go only to who should see them.

A bot's core memory is now general knowledge shared by every user it
works for; what it learns about a user lives in bot_user_memories.

One-off scripts move existing installs over: move-bot-memory-to-owners
(run first), then share-crew.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/functions/backend/db/profile-images/set-profile-image.ts

@@ -7,6 +7,7 @@ import grabUserWorkspace from "@/src/functions/backend/db/workspaces/grab-user-w
 import type { ProfileImageTarget } from "@/src/schemas/profile-image-schema";
 import AppError from "@/src/utils/app-error";
 import bufferFromBase64 from "@/src/utils/buffer-from-base-64";
+import assertCrewManager from "@/src/functions/backend/db/access/assert-crew-manager";
 
 type Params = {
     user_id: number | string;
@@ -28,6 +29,8 @@ const Targets = {
  * a private image, the old one deleted. Returns the new `image_media_id`.
  */
 export default async function setProfileImage({ user_id, target, id, data_url }: Params) {
+    await assertCrewManager({ user_id });
+
     const record =
         target == "bot"
             ? await grabUserBot({ bot_id: id, user_id })