Knowledge bases, and a file input that lines up

**Bases.** Documents now live in named collections rather than one flat pile,
and a chat can be pointed at particular ones — "answer from the contracts
folder" is a different question from "answer from everything I have ever
uploaded". A chat with none attached still searches everything its owner can
see, because empty means unscoped, not empty.

The harness names the attached bases. Without that the model cannot tell "there
is nothing about this" from "I am only allowed to see one folder", and it
phrases a miss as the former.

**Sharing moves to the base.** A document is visible to whoever can see the base
it lives in, so `Document` is gone from the shareable types and
`documents.visible()` filters through `base_id`. "This folder is the team's" is
the granularity people think in; per-document grants meant answering "who can
see this?" by checking every file. Moving a document between bases changes who
can see it, so the destination has to be one you own.

`Document.base_id` is nullable only because the column had to be added to a
table that already had rows. `sweep_unfiled()` runs at startup beside the
orphaned-upload sweep and files anything predating bases into its owner's
default, which is what makes "always set" true everywhere else.

**The file input.** `.input` gave it a fixed height and horizontal padding, so
the browser's own button sat hard against the left edge while the filename
floated off the centre line. A file input is two controls in one box and
neither inherits anything useful, so it gets its own rule: no horizontal
padding, the button sized to `--control-h` with the divider that separates it,
and the text centred with line-height rather than flexbox, which file inputs do
not lay out reliably.

437 tests, ruff clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -19,7 +19,7 @@ lembas info                         # paths + counts, useful when confused
 lembas secret-key                   # generate LEMBAS_SECRET_KEY
 lembas create-admin                 # create or promote an admin
 
-pytest                              # 428 tests, ~26s
+pytest                              # 437 tests, ~27s
                                     # PLAN.md tracks what is and is not built
 ruff check .                        # lint (line length 100)
 python scripts/build_artwork.py     # regenerate artwork (SVG + PWA icons;
@@ -305,6 +305,23 @@ injected, body fetched by tool). The shape of each follows from how it reaches
 the model: a memory is capped short because it costs tokens on every request
 forever, a note is not injected because a dozen would fill the window.
 
+**Documents live in knowledge bases, and the base is what is shared.** A
+`Document` always belongs to a `KnowledgeBase`; visibility comes from the base,
+never the document, which is why `Document` is absent from
+`sharing.RESOURCE_TYPES` and `documents.visible()` filters on
+`base_id IN (visible bases)`. Per-document grants would mean answering "who can
+see this?" by checking every file. `Document.base_id` is nullable only because
+the column had to be added to a table that already had rows;
+`documents.sweep_unfiled()` runs at startup and files anything predating bases
+into its owner's default.
+
+**A chat attached to bases is scoped to them.** `Chat.knowledge_bases` is
+many-to-many; empty means "everything the owner can see", not "nothing".
+`tools.context_for(db, user, chat)` carries the ids and `knowledge_search`
+filters on them — and the harness names the bases, because otherwise the model
+cannot tell "there is nothing about this" from "I am only allowed to see the
+contracts folder".
+
 **Sharing goes through one helper, and admins do not bypass it.**
 `services/sharing.py:visible_to()` is the only definition of who can see a
 library item, and every listing and tool uses it. `permissions.resolve` gives an