Working chat: auth, connections, streaming, folders

LLeMbas now runs end to end. Register, add an OpenAI-compatible
connection, and hold a real streaming conversation organised into
folders. Verified against the local llama-swap instance.

Streaming is the one genuinely tricky part. Sending a message returns
two HTML fragments -- the user bubble and an empty assistant bubble
carrying an sse-connect -- and that attribute is the ONLY thing that
starts a generation. Rendering an incomplete assistant message as a
streaming shell falls out of the same template, which means loading a
page whose last reply never finished simply picks it up again.

Details worth knowing about, each commented where it matters:

- SSE payloads are split across several data: lines. A raw newline in
  one data: line truncates the event, which shows up the first time a
  model emits a code block.
- Markdown is rendered server-side by the same helper for both the page
  and the final streamed frame, so the two cannot disagree. The fence
  renderer is replaced outright rather than using markdown-it's
  highlight option, which re-wraps output in a second <pre>.
- escape_text is html.escape, not nh3.clean_text: it escapes character
  by character, so escaping stream chunks separately equals escaping
  the whole string.
- The stream opens its own session via session_scope(); it outlives the
  request handler and the dependency-scoped session may be closed.
- Deleting a folder keeps the chats inside it (FK is SET NULL). Losing
  a conversation to a mis-clicked folder delete is unforgivable.
- Login failures use one message for "no such account" and "wrong
  password" so the form cannot enumerate registered addresses.

Also adds deploy/ for the gamebox install at https://chat.lan: system
unit, nginx vhost with buffering off (buffering on turns streaming into
one lump at the end), and install/update scripts following the same
service-user and /srv bind-mount conventions as llama-swap and comfyui.

70 tests, ruff clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/lembas/web/templates/admin/models.html

@@ -0,0 +1,51 @@
+{% extends "admin/_layout.html" %}
+{% from "_macros.html" import icon %}
+{% set section = "models" %}
+
+{% block title %}Models - LLeMbas{% endblock %}
+{% block heading %}Models{% endblock %}
+
+{% block admin_content %}
+<p class="admin-lede">
+  Every model discovered on each connection. Disable the ones you do not want
+  cluttering the chat picker — nothing is deleted, and re-running
+  “Test &amp; refresh” will not bring a disabled model back on.
+</p>
+
+{% for connection in connections %}
+<section class="card">
+  <h2 class="card__title">
+    {{ connection.name }}
+    <span class="badge">{{ connection.models|length }}</span>
+    {% if not connection.enabled %}<span class="badge">connection disabled</span>{% endif %}
+  </h2>
+
+  {% if not connection.models %}
+  <p class="muted text-sm">
+    No models loaded. Run “Test &amp; refresh” on
+    <a href="/admin/connections">the connections page</a>.
+  </p>
+  {% else %}
+  <ul class="model-list">
+    {% for model in connection.models %}
+    <li class="model-list__item">
+      <code class="model-list__id">{{ model.model_id }}</code>
+      <form method="post" action="/admin/models/{{ model.id }}/toggle">
+        <button class="btn btn--sm {{ 'btn--primary' if model.enabled }}" type="submit">
+          {% if model.enabled %}{{ icon("check", "icon--sm") }} Enabled{% else %}Disabled{% endif %}
+        </button>
+      </form>
+    </li>
+    {% endfor %}
+  </ul>
+  {% endif %}
+</section>
+{% else %}
+<div class="empty" style="padding: var(--sp-10) 0">
+  {{ icon("server", "empty__mark") }}
+  <p class="empty__text">
+    No connections yet. <a href="/admin/connections">Add one</a> to load models.
+  </p>
+</div>
+{% endfor %}
+{% endblock %}