Fix bulk actions, create chats lazily, rework the UI

Seven reported problems.

**Bulk model actions 404'd.** /admin/models/{model_id} was registered
before /admin/models/bulk, and FastAPI matches in registration order, so
"bulk" was parsed as a model id. Moved above the parameterised route,
with a comment saying why, and a regression test.

**Empty chats piled up.** There is now no endpoint that creates one.
"New chat" is a link to /chat, which renders a composer with no row
behind it, and POST /api/chats/start writes the chat together with its
first message. Opening one and walking away leaves nothing.

**Pinning meant two different things.** The picker is now always in the
administrator's position order; pinned models get shortcuts in the chat
sidebar and nothing else. A picker whose order silently differs from the
admin screen is just confusing.

**Model images were missing in chat.** Assistant bubbles now show the
avatar of the model that actually wrote the turn -- which is not always
the model the chat is set to now -- falling back to the LLeMbas mark.
The picker shows it too.

**No global or per-model system prompt.** Three layers now: instance
(Admin -> General), model (Admin -> Models), chat. Precedence, not
concatenation: most specific wins outright. Stacking them reads well in
a settings screen and badly in practice, because two layers that
disagree give the model contradictory instructions and nobody can tell
which is losing. The chat panel shows the inherited prompt as
placeholder text so "leave empty to inherit" is not a guess.

**Alignment and button sizing.** Added --control-h and friends to
tokens.css; every button, input and select takes its height from them,
so a mixed row is flush by construction rather than by per-instance
nudging. Icon buttons are square at that height. Added .btn-row,
.card__header/.card__footer and .grid so pages stop carrying inline
styles, and moved every admin page onto them.

**Settings needed structure.** The user settings page is now tabbed
(Account / Models / Appearance / Security) using radio inputs and
sibling selectors -- no JavaScript, and the browser keeps the chosen tab
across a re-render.

Caught while checking: the chat.css surgery had deleted the attachment,
chip and dropzone rules. Restored, and there is now a check that every
literal class used in a template has a CSS rule.

197 tests, ruff clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -19,7 +19,7 @@ lembas info                         # paths + counts, useful when confused
 lembas secret-key                   # generate LEMBAS_SECRET_KEY
 lembas create-admin                 # create or promote an admin
 
-pytest                              # 186 tests, ~7s
+pytest                              # 197 tests, ~7s
 ruff check .                        # lint (line length 100)
 python scripts/build_artwork.py     # regenerate all SVG artwork
 python scripts/fetch_vendor.py      # verify vendored JS against the lockfile
@@ -35,9 +35,10 @@ redesign, not a tweak.
    committed under `web/static/vendor/`.
 2. **Nothing loads from a CDN at runtime.** A self-hosted tool must work
    offline and must not report page views to a third party.
-3. **No hard-coded colours outside `tokens.css`.** Every colour, space and
-   radius resolves through a CSS variable. That is what makes a new theme one
-   new block rather than an audit of every stylesheet.
+3. **No hard-coded values outside `tokens.css`.** Every colour, space, radius
+   and control height resolves through a CSS variable. `--control-h` is why
+   buttons, inputs and selects line up: they all take their height from it, so
+   a mixed row is flush by construction rather than by nudging.
 4. **Additive-only schema changes.** SQLite only, no Alembic. `init_db()` runs
    `db/migrations.py:sync_schema()`, which creates missing tables *and* adds
    missing columns by diffing the models against the database. Renames, drops
@@ -190,6 +191,27 @@ null in the composer; `files.claim()` binds them, and only unclaimed rows owned
 by that user, so a forged id cannot pull in someone else's file. Abandoned ones
 are swept at startup.
 
+**Chats are created lazily.** There is no endpoint that makes an empty chat.
+"New chat" is a link to `/chat`, which renders a composer with no row behind
+it; `POST /api/chats/start` writes the chat together with its first message.
+That is why an opened-and-abandoned chat never appears in the sidebar. Tests
+that just need a chat use the `make_chat` fixture rather than the HTTP flow.
+
+**Route order matters for static path segments.** FastAPI matches in
+registration order, so `/admin/models/bulk` must be registered *before*
+`/admin/models/{model_id}` or "bulk" is parsed as a model id and 404s. This has
+already been a bug once.
+
+**Pinning is not ordering.** The model picker is always in the administrator's
+`position` order. Pinned models get shortcuts in the chat sidebar and nothing
+else -- a picker whose order differs from the admin screen is just confusing.
+
+**System prompts are precedence, not concatenation.** chat > model > instance,
+most specific wins outright (`services/chat.py:effective_system_prompt`).
+Stacking them reads well in a settings screen and badly in practice: two layers
+that disagree give the model contradictory instructions and nobody can tell
+which is losing.
+
 **JSON columns need reassignment.** `user.settings_json["theme"] = x` on a
 plain dict is not detected. The columns use `MutableDict` (`db/types.py`), but
 the safe habit is `obj.field = {**obj.field, "k": v}`.