Live Markdown, stop, rewind, custom picker, dialogs

Seven things.

**Reasoning starts closed.** The answer is what the reader is waiting
for; the thinking is one click away.

**Image borders.** .attachments__image was a block-level <a>, so its
border stretched the full column around a narrow picture. inline-block,
and the frame is the picture. Same fix for the composer thumbnail.

**Markdown now renders during the stream.** The generator re-renders the
answer so far and sends it as a `render` event at most every 100ms,
swapped with innerHTML, instead of appending escaped tokens and
formatting everything at the end. Re-rendering whole rather than
appending is the point: a list or a code fence is only correct once its
context exists, and partial syntax resolves itself as more arrives.
Measured against a live model: 29 render events, formatting visible from
the first content token.

**Stop button.** A stop request goes into an in-process set the
generator checks between chunks; whatever arrived is kept, because a
half-written answer the reader chose to cut short is still worth having.
Measured: stream ended 0.2s after the request, 1155 characters
preserved, message marked stopped rather than errored. Navigating away
does the same thing via CancelledError.

**Rewind and edit.** Edit one of your own turns and everything after it
is deleted, then the conversation runs on from there. Deliberately not
branching: that needs a UI for choosing between versions, and "go back
and try again from here" is what was asked for. The form states how many
messages will be discarded before you confirm.

**Custom model picker.** A <select> renders only text in an <option>, so
it can never show an avatar. Built from buttons and a hidden input, with
descriptions, capability tags, a filter box past eight models, and
arrow-key navigation written out by hand since there is no native widget
doing it.

**Notification system.** lembas.notify/confirm/prompt in ui.js, built on
<dialog> so focus trapping, Escape and page inertness come from the
browser. htmx:confirm is intercepted, so every existing hx-confirm gets
the themed dialog with no change at the call site; the browser's grey
confirm() is gone from every template.

230 tests, ruff clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/lembas/web/templates/chat/index.html

@@ -27,26 +27,7 @@
       <div class="topbar__actions">
         {% if models %}
           {% if can.get("chat.model_select") or not chat %}
-          {# Models are listed in the administrator's order. Pinning is a
-             sidebar shortcut and deliberately does not reorder this. #}
-          <label class="model-select">
-            {% if current_model %}{{ model_avatar(current_model, cls="model-select__avatar") }}{% endif %}
-            <select class="select select--bare" name="model_id" id="model-select"
-                    aria-label="Model"
-                    {% if chat %}hx-patch="/api/chats/{{ chat.id }}" hx-swap="none"
-                                 hx-trigger="change"{% else %}onchange="
-                      const u = new URL(window.location);
-                      u.searchParams.set('model', this.value);
-                      window.location = u;
-                    "{% endif %}>
-              {% for model in models %}
-              <option value="{{ model.model_id }}"
-                      {{ 'selected' if current_model and model.model_id == current_model.model_id }}>
-                {{ model.label }}
-              </option>
-              {% endfor %}
-            </select>
-          </label>
+            {% include "chat/_model_picker.html" %}
           {% elif current_model %}
           <span class="badge">{{ current_model.label }}</span>
           {% endif %}