Working chat: auth, connections, streaming, folders

LLeMbas now runs end to end. Register, add an OpenAI-compatible
connection, and hold a real streaming conversation organised into
folders. Verified against the local llama-swap instance.

Streaming is the one genuinely tricky part. Sending a message returns
two HTML fragments -- the user bubble and an empty assistant bubble
carrying an sse-connect -- and that attribute is the ONLY thing that
starts a generation. Rendering an incomplete assistant message as a
streaming shell falls out of the same template, which means loading a
page whose last reply never finished simply picks it up again.

Details worth knowing about, each commented where it matters:

- SSE payloads are split across several data: lines. A raw newline in
  one data: line truncates the event, which shows up the first time a
  model emits a code block.
- Markdown is rendered server-side by the same helper for both the page
  and the final streamed frame, so the two cannot disagree. The fence
  renderer is replaced outright rather than using markdown-it's
  highlight option, which re-wraps output in a second <pre>.
- escape_text is html.escape, not nh3.clean_text: it escapes character
  by character, so escaping stream chunks separately equals escaping
  the whole string.
- The stream opens its own session via session_scope(); it outlives the
  request handler and the dependency-scoped session may be closed.
- Deleting a folder keeps the chats inside it (FK is SET NULL). Losing
  a conversation to a mis-clicked folder delete is unforgivable.
- Login failures use one message for "no such account" and "wrong
  password" so the form cannot enumerate registered addresses.

Also adds deploy/ for the gamebox install at https://chat.lan: system
unit, nginx vhost with buffering off (buffering on turns streaming into
one lump at the end), and install/update scripts following the same
service-user and /srv bind-mount conventions as llama-swap and comfyui.

70 tests, ruff clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/lembas/api/pages.py

@@ -0,0 +1,109 @@
+"""Full-page routes: the chat shell and the user's own settings."""
+
+from __future__ import annotations
+
+from fastapi import APIRouter, HTTPException, Request, status
+from fastapi.responses import RedirectResponse
+from sqlalchemy import select
+from sqlalchemy.orm import Session as DBSession
+
+from lembas.api.deps import Db, RequiredUser
+from lembas.db.models import Chat, Folder, Message, User
+from lembas.services import chat as chat_service
+from lembas.services.markdown import render_markdown
+from lembas.web.templating import render
+
+router = APIRouter(tags=["pages"])
+
+
+def _sidebar_context(db: DBSession, user: User) -> dict:
+    """Folder tree plus the chats that belong to no folder.
+
+    Only root folders are queried; children come through the relationship and
+    render recursively in the template.
+    """
+    folders = list(
+        db.scalars(
+            select(Folder)
+            .where(Folder.user_id == user.id, Folder.parent_id.is_(None))
+            .order_by(Folder.position, Folder.name)
+        )
+    )
+    unfiled = list(
+        db.scalars(
+            select(Chat)
+            .where(
+                Chat.user_id == user.id,
+                Chat.folder_id.is_(None),
+                Chat.archived.is_(False),
+            )
+            .order_by(Chat.pinned.desc(), Chat.updated_at.desc())
+        )
+    )
+    return {"folders": folders, "unfiled_chats": unfiled}
+
+
+@router.get("/")
+async def home(user: RequiredUser):
+    return RedirectResponse("/chat", status_code=status.HTTP_303_SEE_OTHER)
+
+
+@router.get("/chat")
+async def chat_index(request: Request, db: Db, user: RequiredUser):
+    return render(
+        request,
+        "chat/index.html",
+        {
+            "chat": None,
+            "messages": [],
+            "models": chat_service.available_models(db),
+            **_sidebar_context(db, user),
+        },
+    )
+
+
+@router.get("/chat/{chat_id}")
+async def chat_detail(request: Request, db: Db, user: RequiredUser, chat_id: str):
+    chat = db.get(Chat, chat_id)
+    if chat is None or chat.user_id != user.id:
+        raise HTTPException(status.HTTP_404_NOT_FOUND, "That chat no longer exists.")
+
+    messages = list(
+        db.scalars(
+            select(Message).where(Message.chat_id == chat.id).order_by(Message.created_at)
+        )
+    )
+
+    # Markdown is rendered once here rather than in the template so the same
+    # helper produces the page and the streamed final frame -- one code path,
+    # no chance of the two disagreeing.
+    bodies = {
+        message.id: render_markdown(message.content)
+        for message in messages
+        if message.role == "assistant" and message.content
+    }
+
+    return render(
+        request,
+        "chat/index.html",
+        {
+            "chat": chat,
+            "messages": messages,
+            "bodies": bodies,
+            "models": chat_service.available_models(db),
+            **_sidebar_context(db, user),
+        },
+    )
+
+
+@router.get("/settings")
+async def settings_page(request: Request, db: Db, user: RequiredUser):
+    return render(
+        request,
+        "settings.html",
+        {
+            "chat": None,
+            "models": chat_service.available_models(db),
+            **_sidebar_context(db, user),
+        },
+    )