Share one crew across the install, keep user memory per user

Bots, workspaces and computers now belong to the install. Users reach
workers only through bot_users (assigned by a super admin or admin) and
workspace_users; the coordinator and main computer are one per install,
and only the super admin sees the coordinator. Conversations are per
user (bot_sessions.user_id), jobs run for the session's user, and live
updates go only to who should see them.

A bot's core memory is now general knowledge shared by every user it
works for; what it learns about a user lives in bot_user_memories.

One-off scripts move existing installs over: move-bot-memory-to-owners
(run first), then share-crew.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/functions/server/media/handle-media-server.ts

@@ -4,6 +4,7 @@ import grabDirNames from "@/src/utils/grab-dir-names";
 import { existsSync } from "node:fs";
 import path from "node:path";
 import userAuth from "../../backend/auth/user-auth";
+import grabSharedPictureMedia from "@/src/functions/backend/db/access/grab-shared-picture-media";
 
 const { DATA_DIR } = grabDirNames();
 
@@ -48,7 +49,10 @@ export default async function handleMediaServer({
             targetId: media_id,
         });
 
-        media = media_res.singleRes || undefined;
+        media =
+            media_res.singleRes ||
+            (media_id ? await grabSharedPictureMedia({ media_id, user_id: user.id! }) : null) ||
+            undefined;
     } else {
         const media_res = await BunSQLite.select<
             BUN_SQLITE_COBBLE_MEDIA,
@@ -62,7 +66,8 @@ export default async function handleMediaServer({
 
         /**
          * A private file is only served through `/media/private`, to its
-         * owner.
+         * owner (or, for a bot's or workspace's picture, to whoever sees
+         * it).
          */
         if (media?.is_private) {
             media = undefined;