Model rules: who a chat's model may bring into a conversation

Rules read from the main model decide who it is offered as a crowd member,
a friend and on its roster; any-to-any with denies by default, or
none-to-none with allows. The crowd picker names what it holds back and
why, and a model held back only by a person's own rule -- or by anything,
with the new rules.override -- can still be added by hand. Another data
group is now a deny that an explicit rule opens. Admin -> Model rules and
a card in Settings, each with a matrix drawn by the enforcing function.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/lembas/main.py

@@ -23,6 +23,7 @@ from lembas.api import (
     admin_images,
     admin_models,
     admin_prompts,
+    admin_rules,
     admin_schedules,
     admin_search,
     admin_suggestions,
@@ -231,6 +232,7 @@ def create_app() -> FastAPI:
     app.include_router(admin_agents.router)
     app.include_router(admin_crowd.router)
     app.include_router(admin_data_groups.router)
+    app.include_router(admin_rules.router)
     app.include_router(push.router)
     app.include_router(branding.router)