Files that outlived the chats that held them, and a page that led with its footnotes

The second audit pass. Four things, and the first two were reported.

The Prompts page put a screen of variables and a screen of preview above
the editor, so the tabs began two screens down and switching one had to
drag the whole page to be any use -- and on a short tab it could not drag
far enough, leaving the panel stranded above a screenful of nothing.
Editor first, reference after, bar sticky. Custom themes were three fixed
slots: fifty-seven empty colour boxes on a fresh instance and no way to
make a fourth theme. One block per theme plus a blank one, colours behind
a disclosure. Both measured rather than argued about -- rendered through
TestClient and driven under headless Chromium, where the tab bar moved
385->642px before and does not move now, and the themes page went from
5495px to 2820px.

Asking where generated images go found the other two. Deleting a chat
cascades to the attachment rows and leaves every file on disk; the helper
written for exactly that was called from one place, and it was not the
delete button, a schedule's chat, a helper's chat or deleting an account.
Underneath it, `claim` bound message_id and never chat_id, so anything
picked before a chat existed kept an empty chat_id forever -- which six
readers filter on, so those files were also unnamed in the prompt,
unopenable in the canvas, and invisible to the one caller the cleanup had.

And folders nest now. The route has handled parent_id since folders
existed, with a cycle guard and a depth cap the move path never applied;
the sidebar has always drawn a tree. Nothing could ask for one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -16,6 +16,56 @@ for 1.0.0 have something to be assembled from.
 
 ## Unreleased
 
+## 0.9.10
+
+**The second audit pass: screens that were harder to use than they needed to
+be.** Checked by rendering them in a real browser and measuring, not by reading
+the CSS.
+
+- Fixed: **the Prompts admin page put its reference material first.** The
+  Variables legend and the Preview run to a screen each and sat above the tabs,
+  so the editor — the thing the page is for — started two screens down and every
+  tab switch had to move the whole page to be any use. On a short tab it could
+  not move far enough and left the panel stranded above a screenful of nothing.
+  The editor comes first now, the reference after, and the tab bar stays put:
+  measured, it moved 385→642px between tabs before and does not move at all now.
+  The tab bar also sticks to the top, so a long panel does not scroll it away.
+- Fixed: **custom themes were three fixed slots.** A fresh instance opened on
+  fifty-seven empty colour boxes under three identical headings, and a fourth
+  theme could not be made at all. Now: one block per theme you have, plus one
+  blank to add the next, with the colours behind a disclosure — so a theme is a
+  name and a starting point until you ask for more. Up to twelve. The page is
+  half the height it was.
+- Fixed: **deleting a chat left every file it held on disk.** The rows went —
+  the message, the attachments, the generated images — and the files they named
+  stayed, with nothing that would ever look at them again. Four of the five ways
+  a chat can end had this: the delete button, a schedule's task chat, a helper's
+  hidden chat, and deleting an account. There is one function that deletes a
+  chat now, and it removes the files first.
+- Fixed, and it is what made the above invisible: **a file attached before the
+  chat existed never learned which chat it belonged to.** Anything picked on the
+  new-chat screen kept an empty `chat_id` for the rest of its life. Six things
+  filter on that, so for those files the model was not told they were attached,
+  the canvas would not open them, and the cleanup could not find them.
+- **Folders can be nested, which the README has always claimed.** The route has
+  handled it since folders existed — cycle guard, depth limit — and the sidebar
+  has always drawn a tree; there was simply no control that could ask for it.
+  Moving a folder also respects the depth limit now, which only creating one did.
+- The Proxmox container installs the **update helper by default**. A container
+  made thirty seconds ago to run one thing is not the shared host the plain
+  installer has to be careful about, and an appliance you cannot update without
+  a shell is one nobody updates. `INSTALL_UPDATE_HELPER=0` opts out. Docker
+  deliberately has no equivalent: updating a container is pulling an image, and
+  a helper inside one would need the Docker socket, which is root on the host.
+- The starting points on the new-chat screen are four new ones, aimed at
+  somebody who has just stood an instance up and wants to know what is behind
+  it. Only a fresh install gets them; an instance that has already seeded keeps
+  whatever its administrator has made of the list.
+- `README.md` describes what this actually is again — schedules, reports,
+  helpers, image generation, semantic search, quotas, sharing, branding and the
+  updates page were all missing, and two things listed as *planned* had shipped.
+  It gained sections on Docker, the Proxmox container and updating.
+
 ## 0.9.9
 
 **The first of five audit passes before 1.0.0** — everything that landed between