Fix attachments never being sent with the message

Uploading an image showed the chip and then did nothing: the file was
stored but never reached the model.

Two causes, both in the composer template.

The chips live in #attachments, and each carries the hidden file_ids
input that binds it to the message. That container sat OUTSIDE the
<form>, with an `hx-include="#attachments"` on a hidden <div> inside the
form meant to pull it back in. That attribute only has an effect on the
element issuing the request -- on a child of it, it does nothing. So the
form serialised content and nothing else, and post_message saw no
file_ids at all. Fixed by putting #attachments inside the form, where
the inputs are submitted because they are in the form, rather than
because of an attribute that has to be wired correctly. The file input
stays outside, since inside it would submit an empty file part on every
message.

Second: /chat preselected models[0] rather than the model a new chat
would actually use. With a vision model set as the default and a
non-vision one first in the admin ordering, the composer showed the
wrong model, sent the wrong model, and told the user images *would* be
sent when they would not. It now resolves through default_model(), the
same path /start uses.

Every server-side test passed throughout, because the bug was entirely
in the wiring between template and browser. Added tests that serialise
the rendered form the way a browser does -- every named input inside
<form> -- and assert file_ids is among them and the image reaches the
model as a content part. Verified they fail with the old markup
restored, then pass again.

Confirmed end to end against gemma4-e4b-q8: given a drawing, it replied
"Left: Green Circle / Right: Orange Triangle".

220 tests, ruff clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/lembas/web/static/js/app.js

@@ -107,15 +107,17 @@
      rejection) then appears immediately, and a large file cannot make the send
      button appear to hang. */
   function uploadFiles(fileList) {
-    var form = document.getElementById("upload-form");
+    var input = document.getElementById("file-input");
     var target = document.getElementById("attachments");
-    if (!form || !target || !fileList || !fileList.length) return;
+    if (!input || !target || !fileList || !fileList.length) return;
+
+    var url = input.dataset.uploadUrl;
 
     Array.prototype.forEach.call(fileList, function (file) {
       var body = new FormData();
       body.append("file", file, file.name);
 
-      fetch(form.getAttribute("hx-post"), { method: "POST", body: body })
+      fetch(url, { method: "POST", body: body, credentials: "same-origin" })
         .then(function (response) { return response.text(); })
         .then(function (html) {
           target.insertAdjacentHTML("beforeend", html);