Model rules: who a chat's model may bring into a conversation

Rules read from the main model decide who it is offered as a crowd member,
a friend and on its roster; any-to-any with denies by default, or
none-to-none with allows. The crowd picker names what it holds back and
why, and a model held back only by a person's own rule -- or by anything,
with the new rules.override -- can still be added by hand. Another data
group is now a deny that an explicit rule opens. Admin -> Model rules and
a card in Settings, each with a matrix drawn by the enforcing function.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/lembas/web/templates/admin/_layout.html

@@ -63,6 +63,10 @@
           {{ icon("users", "icon--sm") }}
           <span class="nav-item__label">{{ t("A crowd") }}</span>
         </a>
+        <a class="nav-item {{ 'is-active' if section == 'rules' }}" href="/admin/rules">
+          {{ icon("users", "icon--sm") }}
+          <span class="nav-item__label">{{ t("Model rules") }}</span>
+        </a>
         <a class="nav-item {{ 'is-active' if section == 'audio' }}" href="/admin/audio">
           {{ icon("speaker", "icon--sm") }}
           <span class="nav-item__label">{{ t("Audio") }}</span>