Users, groups, permissions, model settings and reasoning display

Four features, plus the schema machinery they needed.

**Schema sync.** The first live instance had data in it, and create_all
only creates missing *tables* -- a new column silently never appeared.
db/migrations.py now diffs the declared models against the database and
ALTER TABLE ... ADD COLUMN for what is missing, deriving a backfill
default from the column type (SQLite refuses a NOT NULL column without
one, and a Python-side `default=dict` cannot be expressed in DDL).
Verified against a copy of the live database: eight changes applied, all
rows preserved, second run a no-op. Renames, drops and retypes are still
manual and say so.

**Permissions.** A flat set of named booleans: an instance baseline
widened by each group the user belongs to. A group grants and never
denies -- with denies, "why can this user not do X" cannot be answered
without simulating every group. Admins bypass entirely, because an admin
can grant it back to themselves in two clicks and pretending otherwise
is theatre. Model *access* is separate: public, or granted to groups.
The picker is not the boundary -- switching a chat to a model you cannot
reach is a 403.

**Model settings.** Ordering, pinned-first, an instance default and a
per-user default, display names, descriptions, capability flags, and
uploaded images. Images are stored and served locally rather than by
URL: a remote URL makes every page render a request to a third party.
Uploads are validated by magic number, not the declared content type,
and stored under a random name. Models with no image get a generated
initial whose hue is derived from the model id, so it is stable.

**Reasoning display.** Streams into its own collapsible block above the
answer, labelled "Thought for 14 seconds", collapsed once finished, and
never replayed as context on the next turn. Two sources: the
reasoning_content delta field, and <think> tags inline in content -- the
latter needs a streaming splitter because the tags arrive split across
chunks. Models emitting no reasoning show nothing, via a :has() rule
rather than JavaScript. Verified against qwen35-9b on llama-swap: 694
reasoning events, 52 answer tokens, cleanly separated.

Two bugs found and fixed while testing:

- A bare `Mapped[list]` relationship is treated by SQLAlchemy as a scalar
  and returns None instead of []. It needs the element type.
- FastAPI substitutes the default for an empty form value, so with
  `x: str | None = Form(None)` a submitted `x=` is indistinguishable from
  an absent field. That silently broke clearing a system prompt or a
  temperature. update_chat now reads the raw form and checks key presence.

143 tests, ruff clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/lembas/web/templates/admin/groups.html

@@ -0,0 +1,167 @@
+{% extends "admin/_layout.html" %}
+{% from "_macros.html" import icon, model_avatar %}
+{% set section = "groups" %}
+
+{% block title %}Groups & permissions - LLeMbas{% endblock %}
+{% block heading %}Groups & permissions{% endblock %}
+
+{% block admin_content %}
+<p class="admin-lede">
+  Permissions are a <strong>union</strong>: everyone starts with the baseline
+  below, and each group they belong to can add more. A group never takes
+  something away, so being in a second group can only widen what someone can do.
+  Administrators bypass all of it.
+</p>
+
+{% if saved %}
+<div class="alert alert--success">{{ icon("check", "icon--sm") }} <span>{{ saved }}</span></div>
+{% endif %}
+
+<section class="card">
+  <h2 class="card__title">Baseline permissions</h2>
+  <p class="text-sm muted" style="margin-bottom: var(--sp-4)">
+    What every signed-in user can do before any group is considered. Turn
+    something off here and grant it through a group to make it opt-in.
+  </p>
+
+  <form method="post" action="/admin/permissions/defaults">
+    {% for section_name, defs in permission_groups.items() %}
+    <div class="field">
+      <span class="field__label">{{ section_name }}</span>
+      {% for definition in defs %}
+      <label class="checkbox perm-row">
+        <input type="checkbox" name="permission" value="{{ definition.key }}"
+               {{ 'checked' if baseline[definition.key] }}>
+        <span>
+          <strong>{{ definition.label }}</strong>
+          <span class="perm-row__desc">{{ definition.description }}</span>
+        </span>
+      </label>
+      {% endfor %}
+    </div>
+    {% endfor %}
+    <button class="btn btn--primary" type="submit">Save baseline</button>
+  </form>
+</section>
+
+<h2 class="admin-section-title">
+  Groups <span class="badge">{{ groups|length }}</span>
+</h2>
+
+<section class="card">
+  <form method="post" action="/admin/groups" class="row" style="gap: var(--sp-2)">
+    <input class="input" name="name" placeholder="New group name" required
+           aria-label="New group name">
+    <button class="btn btn--primary" type="submit">
+      {{ icon("plus", "icon--sm") }} Create group
+    </button>
+  </form>
+</section>
+
+{% if not groups %}
+<div class="empty" style="padding: var(--sp-8) 0">
+  {{ icon("users", "empty__mark") }}
+  <p class="empty__text">
+    No groups yet. Create one to grant extra permissions, or to restrict a model
+    to a subset of users.
+  </p>
+</div>
+{% endif %}
+
+{% for group in groups %}
+<section class="card">
+  <form method="post" action="/admin/groups/{{ group.id }}">
+    <div class="row row--between" style="margin-bottom: var(--sp-4)">
+      <strong>{{ group.name }}</strong>
+      <span class="text-xs faint">
+        {{ group.users|length }} member{{ '' if group.users|length == 1 else 's' }},
+        {{ group.models|length }} model{{ '' if group.models|length == 1 else 's' }}
+      </span>
+    </div>
+
+    <div class="field">
+      <label class="field__label" for="gn-{{ group.id }}">Name</label>
+      <input class="input" id="gn-{{ group.id }}" name="name" value="{{ group.name }}" required>
+    </div>
+
+    <div class="field">
+      <label class="field__label" for="gd-{{ group.id }}">Description</label>
+      <input class="input" id="gd-{{ group.id }}" name="description"
+             value="{{ group.description }}" placeholder="What is this group for?">
+    </div>
+
+    <div class="field">
+      <span class="field__label">Grants</span>
+      <p class="field__hint" style="margin-bottom: var(--sp-2)">
+        Anything already in the baseline stays on regardless — these only add.
+      </p>
+      {% for section_name, defs in permission_groups.items() %}
+        {% for definition in defs %}
+        <label class="checkbox perm-row">
+          <input type="checkbox" name="permission" value="{{ definition.key }}"
+                 {{ 'checked' if (group.permissions_json or {}).get(definition.key) }}>
+          <span>
+            <strong>{{ definition.label }}</strong>
+            <span class="perm-row__desc">
+              {{ definition.description }}
+              {% if baseline[definition.key] %}<em>(already in the baseline)</em>{% endif %}
+            </span>
+          </span>
+        </label>
+        {% endfor %}
+      {% endfor %}
+    </div>
+
+    <div class="field">
+      <span class="field__label">Members</span>
+      {% if users %}
+      <div class="checkbox-row">
+        {% for account in users %}
+        <label class="checkbox">
+          <input type="checkbox" name="user_ids" value="{{ account.id }}"
+                 {{ 'checked' if account in group.users }}>
+          <span>{{ account.name }}</span>
+        </label>
+        {% endfor %}
+      </div>
+      {% else %}
+      <p class="field__hint">No users yet.</p>
+      {% endif %}
+    </div>
+
+    <div class="field">
+      <span class="field__label">Model access</span>
+      <p class="field__hint" style="margin-bottom: var(--sp-2)">
+        Models marked “available to everyone” are reachable regardless. These
+        grant access to the restricted ones.
+      </p>
+      {% if models %}
+      <div class="checkbox-row">
+        {% for model in models %}
+        <label class="checkbox {{ 'is-muted' if model.public }}">
+          <input type="checkbox" name="model_ids" value="{{ model.id }}"
+                 {{ 'checked' if model in group.models }}>
+          <span>{{ model.label }}{% if model.public %} <em>(public)</em>{% endif %}</span>
+        </label>
+        {% endfor %}
+      </div>
+      {% else %}
+      <p class="field__hint">No models yet.</p>
+      {% endif %}
+    </div>
+
+    <button class="btn btn--primary" type="submit">Save {{ group.name }}</button>
+  </form>
+
+  <div class="connection__footer">
+    <span class="text-xs faint">Deleting a group leaves its members alone.</span>
+    <form method="post" action="/admin/groups/{{ group.id }}/delete"
+          onsubmit="return confirm('Delete the group “{{ group.name }}”?')">
+      <button class="btn btn--sm btn--danger" type="submit">
+        {{ icon("trash", "icon--sm") }} Delete
+      </button>
+    </form>
+  </div>
+</section>
+{% endfor %}
+{% endblock %}