Working chat: auth, connections, streaming, folders

LLeMbas now runs end to end. Register, add an OpenAI-compatible
connection, and hold a real streaming conversation organised into
folders. Verified against the local llama-swap instance.

Streaming is the one genuinely tricky part. Sending a message returns
two HTML fragments -- the user bubble and an empty assistant bubble
carrying an sse-connect -- and that attribute is the ONLY thing that
starts a generation. Rendering an incomplete assistant message as a
streaming shell falls out of the same template, which means loading a
page whose last reply never finished simply picks it up again.

Details worth knowing about, each commented where it matters:

- SSE payloads are split across several data: lines. A raw newline in
  one data: line truncates the event, which shows up the first time a
  model emits a code block.
- Markdown is rendered server-side by the same helper for both the page
  and the final streamed frame, so the two cannot disagree. The fence
  renderer is replaced outright rather than using markdown-it's
  highlight option, which re-wraps output in a second <pre>.
- escape_text is html.escape, not nh3.clean_text: it escapes character
  by character, so escaping stream chunks separately equals escaping
  the whole string.
- The stream opens its own session via session_scope(); it outlives the
  request handler and the dependency-scoped session may be closed.
- Deleting a folder keeps the chats inside it (FK is SET NULL). Losing
  a conversation to a mis-clicked folder delete is unforgivable.
- Login failures use one message for "no such account" and "wrong
  password" so the form cannot enumerate registered addresses.

Also adds deploy/ for the gamebox install at https://chat.lan: system
unit, nginx vhost with buffering off (buffering on turns streaming into
one lump at the end), and install/update scripts following the same
service-user and /srv bind-mount conventions as llama-swap and comfyui.

70 tests, ruff clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/lembas/web/templates/settings.html

@@ -0,0 +1,70 @@
+{% extends "base.html" %}
+{% from "_macros.html" import icon %}
+
+{% block title %}Your settings - LLeMbas{% endblock %}
+
+{% block head %}
+<link rel="stylesheet" href="{{ url_for('static', path='css/chat.css') }}">
+<link rel="stylesheet" href="{{ url_for('static', path='css/admin.css') }}">
+{% endblock %}
+
+{% block body_attrs %} data-authenticated="true"{% endblock %}
+
+{% block body %}
+<div class="shell">
+  {% include "partials/sidebar.html" %}
+
+  <main class="main">
+    <header class="topbar">
+      <h1 class="topbar__title">Your settings</h1>
+    </header>
+
+    <div class="admin-scroll">
+      <div class="admin-page">
+        <section class="card">
+          <h2 class="card__title">Account</h2>
+          <div class="field">
+            <span class="field__label">Name</span>
+            <p>{{ user.name }}</p>
+          </div>
+          <div class="field">
+            <span class="field__label">Email</span>
+            <p class="mono text-sm">{{ user.email }}</p>
+          </div>
+          <div class="field">
+            <span class="field__label">Role</span>
+            <p>
+              <span class="badge {{ 'badge--gold' if user.is_admin }}">{{ user.role }}</span>
+            </p>
+          </div>
+        </section>
+
+        <section class="card">
+          <h2 class="card__title">Appearance</h2>
+          <div class="row" style="gap: var(--sp-3)">
+            <button class="btn" type="button" onclick="window.lembas.applyTheme('moria')">
+              {{ icon("moon", "icon--sm") }} Moria
+            </button>
+            <button class="btn" type="button" onclick="window.lembas.applyTheme('shire')">
+              {{ icon("sun", "icon--sm") }} Shire
+            </button>
+          </div>
+          <p class="field__hint" style="margin-top: var(--sp-3)">
+            Moria is the dark theme, Shire the light one. Your choice is saved
+            to this browser and to your account.
+          </p>
+        </section>
+
+        <section class="card">
+          <h2 class="card__title">Session</h2>
+          <form method="post" action="/auth/logout">
+            <button class="btn btn--danger" type="submit">
+              {{ icon("logout", "icon--sm") }} Sign out
+            </button>
+          </form>
+        </section>
+      </div>
+    </div>
+  </main>
+</div>
+{% endblock %}