Working chat: auth, connections, streaming, folders

LLeMbas now runs end to end. Register, add an OpenAI-compatible
connection, and hold a real streaming conversation organised into
folders. Verified against the local llama-swap instance.

Streaming is the one genuinely tricky part. Sending a message returns
two HTML fragments -- the user bubble and an empty assistant bubble
carrying an sse-connect -- and that attribute is the ONLY thing that
starts a generation. Rendering an incomplete assistant message as a
streaming shell falls out of the same template, which means loading a
page whose last reply never finished simply picks it up again.

Details worth knowing about, each commented where it matters:

- SSE payloads are split across several data: lines. A raw newline in
  one data: line truncates the event, which shows up the first time a
  model emits a code block.
- Markdown is rendered server-side by the same helper for both the page
  and the final streamed frame, so the two cannot disagree. The fence
  renderer is replaced outright rather than using markdown-it's
  highlight option, which re-wraps output in a second <pre>.
- escape_text is html.escape, not nh3.clean_text: it escapes character
  by character, so escaping stream chunks separately equals escaping
  the whole string.
- The stream opens its own session via session_scope(); it outlives the
  request handler and the dependency-scoped session may be closed.
- Deleting a folder keeps the chats inside it (FK is SET NULL). Losing
  a conversation to a mis-clicked folder delete is unforgivable.
- Login failures use one message for "no such account" and "wrong
  password" so the form cannot enumerate registered addresses.

Also adds deploy/ for the gamebox install at https://chat.lan: system
unit, nginx vhost with buffering off (buffering on turns streaming into
one lump at the end), and install/update scripts following the same
service-user and /srv bind-mount conventions as llama-swap and comfyui.

70 tests, ruff clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/lembas/web/templates/partials/sidebar.html

@@ -0,0 +1,72 @@
+{% from "_macros.html" import icon, brand %}
+{#
+  Sidebar: brand, new chat, the folder tree, then unfiled chats.
+
+  Folders render recursively through _folder.html. Chats appear under their
+  folder, and any chat without one falls to the flat list at the bottom.
+#}
+<aside class="sidebar" id="sidebar" x-data="{ }">
+  <div class="sidebar__header">
+    {{ brand(uid="side") }}
+  </div>
+
+  <div class="sidebar__actions">
+    <button class="btn btn--primary btn--block" hx-post="/api/chats" hx-swap="none">
+      {{ icon("plus", "icon--sm") }} New chat
+    </button>
+    <button class="btn btn--icon" hx-post="/api/folders" hx-swap="none"
+            hx-vals='{"name": "New folder"}' aria-label="New folder" title="New folder">
+      {{ icon("folder") }}
+    </button>
+  </div>
+
+  <nav class="sidebar__scroll" id="sidebar-tree" aria-label="Chats">
+    {% if folders %}
+    <div class="nav-group">
+      <div class="nav-group__label">Folders</div>
+      {% for folder in folders %}
+        {% include "partials/_folder.html" %}
+      {% endfor %}
+    </div>
+    {% endif %}
+
+    <div class="nav-group">
+      <div class="nav-group__label">Chats</div>
+      {% if unfiled_chats %}
+        {% for chat_item in unfiled_chats %}
+          {% include "partials/_chat_link.html" %}
+        {% endfor %}
+      {% else %}
+        <p class="nav-empty">No chats yet. The road begins here.</p>
+      {% endif %}
+    </div>
+  </nav>
+
+  <div class="sidebar__footer">
+    <div class="row row--between">
+      <a class="nav-item" href="/settings" style="flex: 1">
+        {{ icon("user", "icon--sm") }}
+        <span class="nav-item__label">{{ user.name }}</span>
+        {% if user.is_admin %}<span class="badge badge--gold">admin</span>{% endif %}
+      </a>
+    </div>
+    <div class="row" style="gap: var(--sp-1); margin-top: var(--sp-1)">
+      {% if user.is_admin %}
+      <a class="btn btn--icon" href="/admin" aria-label="Admin settings" title="Admin settings">
+        {{ icon("shield") }}
+      </a>
+      {% endif %}
+      <button class="btn btn--icon" type="button" data-theme-toggle
+              aria-label="Switch theme" title="Switch theme">
+        <span class="theme-icon theme-icon--dark">{{ icon("moon") }}</span>
+        <span class="theme-icon theme-icon--light">{{ icon("sun") }}</span>
+      </button>
+      <span class="topbar__spacer"></span>
+      <form method="post" action="/auth/logout">
+        <button class="btn btn--icon" type="submit" aria-label="Sign out" title="Sign out">
+          {{ icon("logout") }}
+        </button>
+      </form>
+    </div>
+  </div>
+</aside>