Users, groups, permissions, model settings and reasoning display

Four features, plus the schema machinery they needed.

**Schema sync.** The first live instance had data in it, and create_all
only creates missing *tables* -- a new column silently never appeared.
db/migrations.py now diffs the declared models against the database and
ALTER TABLE ... ADD COLUMN for what is missing, deriving a backfill
default from the column type (SQLite refuses a NOT NULL column without
one, and a Python-side `default=dict` cannot be expressed in DDL).
Verified against a copy of the live database: eight changes applied, all
rows preserved, second run a no-op. Renames, drops and retypes are still
manual and say so.

**Permissions.** A flat set of named booleans: an instance baseline
widened by each group the user belongs to. A group grants and never
denies -- with denies, "why can this user not do X" cannot be answered
without simulating every group. Admins bypass entirely, because an admin
can grant it back to themselves in two clicks and pretending otherwise
is theatre. Model *access* is separate: public, or granted to groups.
The picker is not the boundary -- switching a chat to a model you cannot
reach is a 403.

**Model settings.** Ordering, pinned-first, an instance default and a
per-user default, display names, descriptions, capability flags, and
uploaded images. Images are stored and served locally rather than by
URL: a remote URL makes every page render a request to a third party.
Uploads are validated by magic number, not the declared content type,
and stored under a random name. Models with no image get a generated
initial whose hue is derived from the model id, so it is stable.

**Reasoning display.** Streams into its own collapsible block above the
answer, labelled "Thought for 14 seconds", collapsed once finished, and
never replayed as context on the next turn. Two sources: the
reasoning_content delta field, and <think> tags inline in content -- the
latter needs a streaming splitter because the tags arrive split across
chunks. Models emitting no reasoning show nothing, via a :has() rule
rather than JavaScript. Verified against qwen35-9b on llama-swap: 694
reasoning events, 52 answer tokens, cleanly separated.

Two bugs found and fixed while testing:

- A bare `Mapped[list]` relationship is treated by SQLAlchemy as a scalar
  and returns None instead of []. It needs the element type.
- FastAPI substitutes the default for an empty form value, so with
  `x: str | None = Form(None)` a submitted `x=` is indistinguishable from
  an absent field. That silently broke clearing a system prompt or a
  temperature. update_chat now reads the raw form and checks key presence.

143 tests, ruff clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/lembas/web/templates/admin/models.html

@@ -1,5 +1,5 @@
 {% extends "admin/_layout.html" %}
-{% from "_macros.html" import icon %}
+{% from "_macros.html" import icon, model_avatar %}
 {% set section = "models" %}
 
 {% block title %}Models - LLeMbas{% endblock %}
@@ -7,45 +7,186 @@
 
 {% block admin_content %}
 <p class="admin-lede">
-  Every model discovered on each connection. Disable the ones you do not want
-  cluttering the chat picker — nothing is deleted, and re-running
-  “Test &amp; refresh” will not bring a disabled model back on.
+  Every model discovered across your connections. The order here is the order
+  users see. Pinned models are offered first, and the default is what a new chat
+  starts with.
 </p>
 
-{% for connection in connections %}
-<section class="card">
-  <h2 class="card__title">
-    {{ connection.name }}
-    <span class="badge">{{ connection.models|length }}</span>
-    {% if not connection.enabled %}<span class="badge">connection disabled</span>{% endif %}
-  </h2>
+{% if saved %}
+<div class="alert alert--success">{{ icon("check", "icon--sm") }} <span>{{ saved }}</span></div>
+{% endif %}
 
-  {% if not connection.models %}
-  <p class="muted text-sm">
-    No models loaded. Run “Test &amp; refresh” on
-    <a href="/admin/connections">the connections page</a>.
-  </p>
-  {% else %}
-  <ul class="model-list">
-    {% for model in connection.models %}
-    <li class="model-list__item">
-      <code class="model-list__id">{{ model.model_id }}</code>
-      <form method="post" action="/admin/models/{{ model.id }}/toggle">
-        <button class="btn btn--sm {{ 'btn--primary' if model.enabled }}" type="submit">
-          {% if model.enabled %}{{ icon("check", "icon--sm") }} Enabled{% else %}Disabled{% endif %}
-        </button>
-      </form>
-    </li>
-    {% endfor %}
-  </ul>
-  {% endif %}
-</section>
-{% else %}
+{% if not models %}
 <div class="empty" style="padding: var(--sp-10) 0">
   {{ icon("server", "empty__mark") }}
   <p class="empty__text">
-    No connections yet. <a href="/admin/connections">Add one</a> to load models.
+    No models yet. <a href="/admin/connections">Add a connection</a> and run
+    “Test &amp; refresh”.
   </p>
 </div>
+{% else %}
+
+<form method="post" action="/admin/models/bulk" class="bulk-bar">
+  <span class="text-sm muted">With selected:</span>
+  <button class="btn btn--sm" name="action" value="enable" type="submit">Enable</button>
+  <button class="btn btn--sm" name="action" value="disable" type="submit">Disable</button>
+  <button class="btn btn--sm" name="action" value="public" type="submit">Make public</button>
+  <button class="btn btn--sm" name="action" value="private" type="submit">Restrict</button>
+
+  <div class="model-rows">
+    {% for model in models %}
+    <div class="model-row {{ 'is-off' if not model.enabled }}">
+      <input class="model-row__check" type="checkbox" name="model_ids" value="{{ model.id }}"
+             aria-label="Select {{ model.label }}">
+
+      {{ model_avatar(model, cls="model-row__avatar") }}
+
+      <div class="model-row__main">
+        <div class="model-row__title">
+          <strong>{{ model.label }}</strong>
+          {% if model.model_id == default_model %}
+          <span class="badge badge--gold">{{ icon("star", "icon--sm") }} default</span>
+          {% endif %}
+          {% if model.pinned %}<span class="badge">pinned</span>{% endif %}
+          {% if not model.enabled %}<span class="badge badge--danger">disabled</span>{% endif %}
+          {% if not model.public %}
+          <span class="badge">{{ model.groups|length }} group{{ '' if model.groups|length == 1 else 's' }}</span>
+          {% endif %}
+          {% for name, on in (model.capabilities_json or {}).items() %}
+            {% if on %}<span class="badge badge--gold">{{ name }}</span>{% endif %}
+          {% endfor %}
+        </div>
+        <code class="model-row__id">{{ model.model_id }}</code>
+        <span class="text-xs faint">via {{ model.connection.name }}</span>
+      </div>
+
+      <div class="model-row__actions">
+        <button class="btn btn--icon btn--sm" type="submit" aria-label="Move up"
+                formaction="/admin/models/{{ model.id }}/move" formmethod="post"
+                name="direction" value="up" {{ 'disabled' if loop.first }}>
+          {{ icon("arrow-up", "icon--sm") }}
+        </button>
+        <button class="btn btn--icon btn--sm" type="submit" aria-label="Move down"
+                formaction="/admin/models/{{ model.id }}/move" formmethod="post"
+                name="direction" value="down" {{ 'disabled' if loop.last }}>
+          {{ icon("arrow-down", "icon--sm") }}
+        </button>
+        <a class="btn btn--sm" href="#model-{{ model.id }}">Edit</a>
+      </div>
+    </div>
+    {% endfor %}
+  </div>
+</form>
+
+<h2 class="admin-section-title">Model settings</h2>
+
+{% for model in models %}
+<section class="card" id="model-{{ model.id }}">
+  <div class="row row--between" style="margin-bottom: var(--sp-4)">
+    <div class="row" style="gap: var(--sp-3); min-width: 0">
+      {{ model_avatar(model, cls="model-row__avatar") }}
+      <div style="min-width: 0">
+        <strong class="truncate">{{ model.label }}</strong>
+        <div><code class="text-xs faint">{{ model.model_id }}</code></div>
+      </div>
+    </div>
+    {% if model.model_id != default_model %}
+    <form method="post" action="/admin/models/{{ model.id }}/default">
+      <button class="btn btn--sm" type="submit">{{ icon("star", "icon--sm") }} Make default</button>
+    </form>
+    {% endif %}
+  </div>
+
+  <form method="post" action="/admin/models/{{ model.id }}">
+    <div class="field">
+      <label class="field__label" for="dn-{{ model.id }}">Display name</label>
+      <input class="input" id="dn-{{ model.id }}" name="display_name"
+             value="{{ model.display_name }}" placeholder="{{ model.model_id }}">
+      <p class="field__hint">Shown instead of the raw model id. Leave empty to use the id.</p>
+    </div>
+
+    <div class="field">
+      <label class="field__label" for="desc-{{ model.id }}">Description</label>
+      <textarea class="textarea" id="desc-{{ model.id }}" name="description" rows="2"
+                placeholder="What is this model good at?">{{ model.description }}</textarea>
+    </div>
+
+    <div class="field">
+      <span class="field__label">Capabilities</span>
+      <div class="checkbox-row">
+        {% for name in capabilities %}
+        <label class="checkbox">
+          <input type="checkbox" name="capability" value="{{ name }}"
+                 {{ 'checked' if (model.capabilities_json or {}).get(name) }}>
+          <span>{{ name }}</span>
+        </label>
+        {% endfor %}
+      </div>
+      <p class="field__hint">
+        Endpoints rarely advertise these reliably, so they are your call.
+        <strong>reasoning</strong> shows the thinking block;
+        <strong>vision</strong> and <strong>tools</strong> are used by features
+        not built yet.
+      </p>
+    </div>
+
+    <div class="field">
+      <div class="checkbox-row">
+        <label class="checkbox">
+          <input type="checkbox" name="enabled" value="true" {{ 'checked' if model.enabled }}>
+          <span>Enabled</span>
+        </label>
+        <label class="checkbox">
+          <input type="checkbox" name="pinned" value="true" {{ 'checked' if model.pinned }}>
+          <span>Pinned — offered first in the picker</span>
+        </label>
+      </div>
+    </div>
+
+    <div class="field">
+      <label class="checkbox">
+        <input type="checkbox" name="public" value="true" {{ 'checked' if model.public }}>
+        <span>Available to everyone</span>
+      </label>
+      <p class="field__hint">
+        Uncheck to restrict this model to specific groups. Administrators always
+        have access.
+      </p>
+      {% if groups %}
+      <div class="checkbox-row" style="margin-top: var(--sp-3)">
+        {% for group in groups %}
+        <label class="checkbox">
+          <input type="checkbox" name="group_ids" value="{{ group.id }}"
+                 {{ 'checked' if group in model.groups }}>
+          <span>{{ group.name }}</span>
+        </label>
+        {% endfor %}
+      </div>
+      {% else %}
+      <p class="field__hint">
+        No groups yet — <a href="/admin/groups">create one</a> to restrict access.
+      </p>
+      {% endif %}
+    </div>
+
+    <button class="btn btn--primary" type="submit">Save {{ model.label }}</button>
+  </form>
+
+  <div class="connection__footer">
+    <form method="post" action="/admin/models/{{ model.id }}/image"
+          enctype="multipart/form-data" class="row" style="gap: var(--sp-2)">
+      <input class="input input--file" type="file" name="image"
+             accept="image/png,image/jpeg,image/webp,image/gif" required
+             aria-label="Model image">
+      <button class="btn btn--sm" type="submit">{{ icon("image", "icon--sm") }} Upload</button>
+    </form>
+    {% if model.image_path %}
+    <form method="post" action="/admin/models/{{ model.id }}/image/delete">
+      <button class="btn btn--sm btn--danger" type="submit">Remove image</button>
+    </form>
+    {% endif %}
+  </div>
+</section>
 {% endfor %}
+{% endif %}
 {% endblock %}