Working chat: auth, connections, streaming, folders

LLeMbas now runs end to end. Register, add an OpenAI-compatible
connection, and hold a real streaming conversation organised into
folders. Verified against the local llama-swap instance.

Streaming is the one genuinely tricky part. Sending a message returns
two HTML fragments -- the user bubble and an empty assistant bubble
carrying an sse-connect -- and that attribute is the ONLY thing that
starts a generation. Rendering an incomplete assistant message as a
streaming shell falls out of the same template, which means loading a
page whose last reply never finished simply picks it up again.

Details worth knowing about, each commented where it matters:

- SSE payloads are split across several data: lines. A raw newline in
  one data: line truncates the event, which shows up the first time a
  model emits a code block.
- Markdown is rendered server-side by the same helper for both the page
  and the final streamed frame, so the two cannot disagree. The fence
  renderer is replaced outright rather than using markdown-it's
  highlight option, which re-wraps output in a second <pre>.
- escape_text is html.escape, not nh3.clean_text: it escapes character
  by character, so escaping stream chunks separately equals escaping
  the whole string.
- The stream opens its own session via session_scope(); it outlives the
  request handler and the dependency-scoped session may be closed.
- Deleting a folder keeps the chats inside it (FK is SET NULL). Losing
  a conversation to a mis-clicked folder delete is unforgivable.
- Login failures use one message for "no such account" and "wrong
  password" so the form cannot enumerate registered addresses.

Also adds deploy/ for the gamebox install at https://chat.lan: system
unit, nginx vhost with buffering off (buffering on turns streaming into
one lump at the end), and install/update scripts following the same
service-user and /srv bind-mount conventions as llama-swap and comfyui.

70 tests, ruff clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/lembas/api/preferences.py

@@ -0,0 +1,29 @@
+"""Per-user preferences set from the browser."""
+
+from __future__ import annotations
+
+from fastapi import APIRouter, Body
+
+from lembas.api.deps import Db, RequiredUser
+
+router = APIRouter(prefix="/api/preferences", tags=["preferences"])
+
+THEMES = ("moria", "shire")
+
+
+@router.post("/theme")
+async def set_theme(db: Db, user: RequiredUser, theme: str = Body(..., embed=True)) -> dict:
+    """Mirror the browser's theme choice onto the account.
+
+    localStorage is the source of truth for the current tab; this is what makes
+    the choice follow the user to another browser, and what lets the server
+    render the right theme on first paint instead of flashing the default.
+    """
+    if theme not in THEMES:
+        return {"ok": False, "detail": "Unknown theme."}
+
+    # Replaced rather than mutated in place: SQLAlchemy only reliably detects
+    # a change to a JSON column when the whole value is reassigned.
+    user.settings_json = {**(user.settings_json or {}), "theme": theme}
+    db.commit()
+    return {"ok": True, "theme": theme}