Data groups: a provider's models read only their own group's data

Every connection is in a data group. Its models are handed, and can find,
only that group's memories, notes, skills, knowledge, reports and
personality -- by search and by id. A chat stays in the group it was
started in: switching its model, the endpoint fallback, the crowd, friends,
bases and the @ menu all stay inside it, and a chat whose model has moved
is refused rather than sent. A group may name its own embedder and image
reviewer. data.manage lets a person make personal groups, remap
connections for themselves and move their own records.

Also: a search no longer mixes two embedders of the same width.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/lembas/web/templates/admin/_layout.html

@@ -50,6 +50,12 @@
           {{ icon("sliders", "icon--sm") }}
           <span class="nav-item__label">{{ t("Models") }}</span>
         </a>
+        {# Beside Connections and Models because it is about them: which
+           provider's models may read which part of the people's data. #}
+        <a class="nav-item {{ 'is-active' if section == 'data-groups' }}" href="/admin/data-groups">
+          {{ icon("shield", "icon--sm") }}
+          <span class="nav-item__label">{{ t("Data groups") }}</span>
+        </a>
         {# Its own entry rather than a card on Agents, where it started. Sitting
            there made it read as an agent-chat feature -- which is what the owner
            took it for, reasonably, since that is what the page is called. #}