A personality belongs to a person

Owner's correction to 1.4.0: a model's character is per (model, person), and only
the description and the notes stay instance-wide. Two people talking to one model
are not talking to the same personality, and neither can see the other's.

The administrator's box becomes the DEFAULT, resolved by `personas.effective` as
a fallback and never as a layer -- two personalities at once contradict each
other with nothing to say which is losing, which is the reasoning behind "system
prompts replace, never stack". `persona_write` takes no argument naming a model
or a person; both come from the ToolContext, so it can only write the character
it has with whoever it is talking to, and it never touches the default.

Impressions move to their own table. Not a `kind` column: 1.4.0 shipped
`UNIQUE(model_key, owner_id)`, SQLite cannot alter a constraint and this schema
is additive-only, so a discriminator would leave an upgraded instance unable to
hold both rows for one pair. That leaves the first MANUAL_STEPS entry this
project has had -- the two shapes are indistinguishable, so nothing rewrites
them: a repair would be guessing at text that is read back in the first person.

TWO BUGS FROM A PHONE

`min-width` beats both `width` and `max-width` -- CSS clamps width to max-width
and then raises the result to min-width -- so `.canvas` and `.terminal` were
384px wide on every screen narrower than that, their `min(…, 100vw)` cap
overruled, and `.inspector` had no cap at all on a width that is a preference
draggable to 2400px. None of it scrolled sideways, because all three are
`position: fixed` and fixed overflow does not extend the scrollable area -- which
is exactly why the 1.1.0 narrow pass reported these pages clean. `min-width: 0`
in the overlay query, full width below the phone breakpoint, tablet column kept.

And the install button now says why it is absent. Measured against the live
instance: the manifest meets every Chrome criterion and the blocker is a
certificate from a private CA, so the origin is not trustworthy, the service
worker is refused and no install is offered. `base.html` had been swallowing that
with an empty catch -- which kept the page working, the reason it was there, and
threw away the only evidence. It now records the outcome and `app.js` turns it
into a sentence naming the certificate, which is the cause the old hint did not
mention.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -16,6 +16,54 @@ for 1.0.0 have something to be assembled from.
 
 ## Unreleased
 
+## 1.5.0
+
+- **A model's personality is now yours, not the instance's.** Each account gets
+  its own version of each model's character: a personality is something a model
+  works out *with somebody*, so two people talking to the same model are no longer
+  talking to the same one, and neither can see the other's. What a model **is** —
+  its description and the facts other models are told about it — stays the same
+  for everybody, because that is a property of the model rather than of a
+  relationship.
+
+  The box on the model's page is now the **default personality**: the starting
+  point somebody has until the model has written its own with them. It is not
+  layered underneath theirs afterwards — two personalities at once would
+  contradict each other and nobody could tell which was losing. Your own
+  personalities, their history, and what each model makes of you are all under
+  **Memory** in your settings, and deleting a personality resets it to the
+  default rather than removing it.
+
+  ⚠ If you installed 1.4.0 — released and superseded the same day — anything a
+  model wrote about you then is sitting in the wrong place and reads as a
+  personality rather than as an impression. There is a note in
+  `db/migrations.py` with the one statement that moves it; deleting it is just as
+  reasonable, since nothing had time to write one worth keeping.
+
+- Fixed: **a side panel was wider than a narrow phone and hung off the edge.**
+  The canvas, the terminal and the details panel all carried a minimum width of
+  384px, which beats the rule that was supposed to cap them at the screen — so on
+  a 360px phone they were 24px too wide with their left-hand edge cut off, and on
+  a 320px one, 64px. Nothing scrolled sideways, which is why a narrow-width pass
+  looking for a horizontal scrollbar never found it: the panels are fixed in
+  place, and fixed overflow does not make a page scroll. They are now exactly as
+  wide as the screen on a phone, and keep their column on a tablet.
+
+  The details panel was worse than the other two: it had no cap at all, and its
+  width is a *preference* you can drag to 2400px on a desktop. That number was
+  arriving verbatim on a phone.
+
+- **The Install button now says why it is missing**, instead of not being there.
+  Four different things stop a browser installing this and all four looked
+  identical; the hint named only the least likely. It now reports whether the page
+  is a secure context, what the browser said if the service worker was refused,
+  and whether the browser simply never offers it — and names the cause that
+  actually bites a self-hosted instance: **a certificate the phone does not
+  trust**. A private or self-signed certificate means no service worker, and no
+  service worker means no install, however good the rest of it is. Installing the
+  CA on the device is the fix, and the app can now tell you that is what is
+  wrong.
+
 ## 1.4.0
 
 - **Models can be told about each other.** A model may now be given a list of