Share one crew across the install, keep user memory per user

Bots, workspaces and computers now belong to the install. Users reach
workers only through bot_users (assigned by a super admin or admin) and
workspace_users; the coordinator and main computer are one per install,
and only the super admin sees the coordinator. Conversations are per
user (bot_sessions.user_id), jobs run for the session's user, and live
updates go only to who should see them.

A bot's core memory is now general knowledge shared by every user it
works for; what it learns about a user lives in bot_user_memories.

One-off scripts move existing installs over: move-bot-memory-to-owners
(run first), then share-crew.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/functions/backend/db/workspaces/grab-user-workspaces.ts

@@ -1,25 +1,30 @@
 import BunSQLite from "@moduletrace/bun-sqlite";
 import type { WorkspaceWithActivity } from "@/src/types";
+import workspacesSql from "@/src/utils/crew-access/workspaces-sql";
+import grabCrewRole from "../access/grab-crew-role";
 
 type Params = {
     user_id: number | string;
 };
 
 /**
- * The user's workspaces for the rail, not archived, oldest first, each
- * unread while any conversation in it is.
+ * The workspaces the user works in (`workspacesSql`), for the rail: not
+ * archived, oldest first, each unread while any of the user's
+ * conversations in it is.
  */
 export default async function grabUserWorkspaces({
     user_id,
 }: Params): Promise<WorkspaceWithActivity[]> {
+    const access = workspacesSql({ role: await grabCrewRole({ user_id }), user_id });
+
     const res = await BunSQLite.sql<WorkspaceWithActivity>({
         sql: `SELECT w.*,
-                COALESCE((SELECT MAX(s.unread) FROM bot_sessions s WHERE s.workspace_id = w.id), 0) AS unread,
-                (SELECT MAX(s.last_activity_at) FROM bot_sessions s WHERE s.workspace_id = w.id) AS last_activity_at
+                COALESCE((SELECT MAX(s.unread) FROM bot_sessions s WHERE s.workspace_id = w.id AND s.user_id = ?), 0) AS unread,
+                (SELECT MAX(s.last_activity_at) FROM bot_sessions s WHERE s.workspace_id = w.id AND s.user_id = ?) AS last_activity_at
             FROM workspaces w
-            WHERE w.user_id = ? AND w.archived = 0
+            WHERE w.archived = 0 AND ${access.sql}
             ORDER BY w.id ASC`,
-        values: [user_id],
+        values: [user_id, user_id, ...access.values],
     });
 
     return res.payload || [];