Knowledge bases, and a file input that lines up

**Bases.** Documents now live in named collections rather than one flat pile,
and a chat can be pointed at particular ones — "answer from the contracts
folder" is a different question from "answer from everything I have ever
uploaded". A chat with none attached still searches everything its owner can
see, because empty means unscoped, not empty.

The harness names the attached bases. Without that the model cannot tell "there
is nothing about this" from "I am only allowed to see one folder", and it
phrases a miss as the former.

**Sharing moves to the base.** A document is visible to whoever can see the base
it lives in, so `Document` is gone from the shareable types and
`documents.visible()` filters through `base_id`. "This folder is the team's" is
the granularity people think in; per-document grants meant answering "who can
see this?" by checking every file. Moving a document between bases changes who
can see it, so the destination has to be one you own.

`Document.base_id` is nullable only because the column had to be added to a
table that already had rows. `sweep_unfiled()` runs at startup beside the
orphaned-upload sweep and files anything predating bases into its owner's
default, which is what makes "always set" true everywhere else.

**The file input.** `.input` gave it a fixed height and horizontal padding, so
the browser's own button sat hard against the left edge while the filename
floated off the centre line. A file input is two controls in one box and
neither inherits anything useful, so it gets its own rule: no horizontal
padding, the button sized to `--control-h` with the divider that separates it,
and the text centred with line-height rather than flexbox, which file inputs do
not lay out reliably.

437 tests, ruff clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -55,7 +55,8 @@ runtime. Clone it, `pip install -e .`, run it.
   any OpenAI-compatible audio endpoint (whisper.cpp, Speaches, Kokoro…). Each
   person picks their own voice
 - **A library** — four places a model can reach for. **Knowledge**: documents,
-  images and web pages you collect, searched before the web. **Notes**: longer
+  images and web pages you collect, grouped into named bases so a chat can be
+  pointed at just the right one, searched before the web. **Notes**: longer
   things it writes down and finds again later. **Memory**: short facts about you,
   in front of it on every turn. **Skills**: saved procedures it can follow, and
   write. All of it visible and editable by you, and shareable with a group or a
@@ -143,6 +144,11 @@ model: give it the tools it should have under **Admin → Models**, where
 `tools` decides whether a tool list may be sent at all and the built-in tools are
 chosen one by one.
 
+Knowledge is organised into **bases** — one per subject, project or client. A
+chat with no base attached searches everything you have; tick some in the chat's
+settings panel and it searches only those. Sharing happens at the base: share it
+and everything in it comes too, read-only.
+
 Search is SQLite's FTS5 — keyword matching with BM25 ranking, no embedding
 service to run and nothing that stops working offline. It will not match a
 paraphrase, so a line of description on a document is worth writing.