Claude Code engine, image viewer, colour tags, checks per turn and more

- Claude Code as an engine: chats on a "claude-code/<alias>" model run through
  the claude CLI (stream-json); tool approvals go through our permission
  system. Sign in from the web UI (URL + pasted code), CLI version and update
  from Settings; the Docker image contains the CLI.
- Small models (8k context) for side tasks: input is cut to the model's
  context window; one-line chat status, "What does this do?" on approvals,
  "Plan as automation" (job draft from a chat).
- Mobile: top bar no longer widens the page, image viewer (zoom, swipe, mark
  up, use in message), jump to previous own message, message menu, time under
  every message.
- Approvals: push actions (allow/reject), "always allow in this project"
  (never for dangerous commands) with revoke.
- Per turn: changed files with diffs and rollback; project check command with
  a green/red badge and "let the agent fix it".
- Colour tags for chats in the colours of the active theme.
- Project defaults for new chats, project page (timeline), offline queue.

Tested in a throwaway container with a mock model (8k small model): 26 API
checks passed (permissions, diffs, checks, defaults, job draft, side-task
budget, Claude Code status/login URL, unsigned-in chat).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

server/src/push.rs

@@ -200,8 +200,12 @@ pub fn spawn_listener(app: Arc<App>) {
                 Err(tokio::sync::broadcast::error::RecvError::Lagged(_)) => continue,
                 Err(_) => break,
             };
+            let mut permission_id = None;
             let (session_id, kind, body) = match &ev {
-                Event::PermissionRequest { session_id, title, tool, .. } => (session_id.clone(), "permission", format!("{tool}: {title}")),
+                Event::PermissionRequest { id, session_id, title, tool, .. } => {
+                    permission_id = Some(id.clone());
+                    (session_id.clone(), "permission", format!("{tool}: {title}"))
+                }
                 Event::QuestionRequest { session_id, questions, .. } => {
                     let q = questions.first().map(|q| q.question.clone()).unwrap_or_default();
                     (session_id.clone(), "question", q)
@@ -228,6 +232,8 @@ pub fn spawn_listener(app: Arc<App>) {
                 continue;
             }
             let payload = json!({
+                // Lets the notification itself approve or reject (service worker → POST /api/permissions/<id>).
+                "permission_id": permission_id,
                 "kind": kind,
                 "title": title,
                 "body": body.chars().take(180).collect::<String>(),