Share one crew across the install, keep user memory per user

Bots, workspaces and computers now belong to the install. Users reach
workers only through bot_users (assigned by a super admin or admin) and
workspace_users; the coordinator and main computer are one per install,
and only the super admin sees the coordinator. Conversations are per
user (bot_sessions.user_id), jobs run for the session's user, and live
updates go only to who should see them.

A bot's core memory is now general knowledge shared by every user it
works for; what it learns about a user lives in bot_user_memories.

One-off scripts move existing installs over: move-bot-memory-to-owners
(run first), then share-crew.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/pages/api/admin/bots/save-harness-settings.ts

@@ -9,6 +9,7 @@ import type { BotHarnessOverviewPayload } from "@/src/types";
 import AppError from "@/src/utils/app-error";
 import parseWithSchema from "@/src/utils/parse-with-schema";
 import isReadOnlyUser from "@/src/utils/rbac/is-read-only-user";
+import canManageCrew from "@/src/utils/rbac/can-manage-crew";
 import safeErrorMessage from "@/src/utils/safe-error-message";
 import type {
     APIResponseObject,
@@ -37,6 +38,10 @@ export const handler: BunextAPIRouteHandler<
             throw new AppError(`This user can only read records.`);
         }
 
+        if (!canManageCrew({ user_types })) {
+            throw new AppError(`Only an admin can do that.`);
+        }
+
         const { bot_id, settings } = parseWithSchema({
             schema: SaveBotHarnessSettingsRequestSchema,
             data: body,