Working chat: auth, connections, streaming, folders

LLeMbas now runs end to end. Register, add an OpenAI-compatible
connection, and hold a real streaming conversation organised into
folders. Verified against the local llama-swap instance.

Streaming is the one genuinely tricky part. Sending a message returns
two HTML fragments -- the user bubble and an empty assistant bubble
carrying an sse-connect -- and that attribute is the ONLY thing that
starts a generation. Rendering an incomplete assistant message as a
streaming shell falls out of the same template, which means loading a
page whose last reply never finished simply picks it up again.

Details worth knowing about, each commented where it matters:

- SSE payloads are split across several data: lines. A raw newline in
  one data: line truncates the event, which shows up the first time a
  model emits a code block.
- Markdown is rendered server-side by the same helper for both the page
  and the final streamed frame, so the two cannot disagree. The fence
  renderer is replaced outright rather than using markdown-it's
  highlight option, which re-wraps output in a second <pre>.
- escape_text is html.escape, not nh3.clean_text: it escapes character
  by character, so escaping stream chunks separately equals escaping
  the whole string.
- The stream opens its own session via session_scope(); it outlives the
  request handler and the dependency-scoped session may be closed.
- Deleting a folder keeps the chats inside it (FK is SET NULL). Losing
  a conversation to a mis-clicked folder delete is unforgivable.
- Login failures use one message for "no such account" and "wrong
  password" so the form cannot enumerate registered addresses.

Also adds deploy/ for the gamebox install at https://chat.lan: system
unit, nginx vhost with buffering off (buffering on turns streaming into
one lump at the end), and install/update scripts following the same
service-user and /srv bind-mount conventions as llama-swap and comfyui.

70 tests, ruff clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/lembas/web/templates/admin/_layout.html

@@ -0,0 +1,73 @@
+{% extends "base.html" %}
+{% from "_macros.html" import icon, brand %}
+{#
+  Shared chrome for the admin area: its own narrow nav rather than the chat
+  sidebar, so administration is visibly a different place from chatting.
+#}
+
+{% block head %}
+<link rel="stylesheet" href="{{ url_for('static', path='css/chat.css') }}">
+<link rel="stylesheet" href="{{ url_for('static', path='css/admin.css') }}">
+{% endblock %}
+
+{% block body_attrs %} data-authenticated="true"{% endblock %}
+
+{% block body %}
+<div class="shell">
+  <aside class="sidebar">
+    <div class="sidebar__header">
+      {{ brand(uid="admin") }}
+    </div>
+
+    <nav class="sidebar__scroll" aria-label="Administration">
+      <div class="nav-group">
+        <div class="nav-group__label">Administration</div>
+        <a class="nav-item {{ 'is-active' if section == 'connections' }}"
+           href="/admin/connections">
+          {{ icon("server", "icon--sm") }}
+          <span class="nav-item__label">Connections</span>
+        </a>
+        <a class="nav-item {{ 'is-active' if section == 'models' }}" href="/admin/models">
+          {{ icon("sliders", "icon--sm") }}
+          <span class="nav-item__label">Models</span>
+        </a>
+      </div>
+
+      <div class="nav-group">
+        <div class="nav-group__label">Not yet built</div>
+        <span class="nav-item is-disabled">
+          {{ icon("users", "icon--sm") }}
+          <span class="nav-item__label">Users &amp; groups</span>
+        </span>
+        <span class="nav-item is-disabled">
+          {{ icon("gear", "icon--sm") }}
+          <span class="nav-item__label">Tools</span>
+        </span>
+      </div>
+    </nav>
+
+    <div class="sidebar__footer">
+      <a class="nav-item" href="/chat">
+        {{ icon("chat", "icon--sm") }}
+        <span class="nav-item__label">Back to chats</span>
+      </a>
+    </div>
+  </aside>
+
+  <main class="main">
+    <header class="topbar">
+      <h1 class="topbar__title">{% block heading %}Administration{% endblock %}</h1>
+      <button class="btn btn--icon" type="button" data-theme-toggle aria-label="Switch theme">
+        <span class="theme-icon theme-icon--dark">{{ icon("moon") }}</span>
+        <span class="theme-icon theme-icon--light">{{ icon("sun") }}</span>
+      </button>
+    </header>
+
+    <div class="admin-scroll">
+      <div class="admin-page">
+        {% block admin_content %}{% endblock %}
+      </div>
+    </div>
+  </main>
+</div>
+{% endblock %}