feat: multiple persona conversations with branching and generated titles

Persona chat stored a flat Vec<ChatMessage> keyed on (user_id, persona_id),
which meant one rolling transcript per persona and no way to revisit a turn.
This moves it onto the same ChatHistoryStore tree the file chat uses and
gives conversations their own identity.

Storage
- messages_json now holds a serialized ChatHistoryStore. Reads accept the
  old flat array and upgrade it in place, so existing transcripts survive
  without a data migration. The upgrade drops the v1 seed greeting, which
  the flat renderer hid but the tree renderer would surface as a bubble the
  user has never seen.
- New migration re-keys persona_chat_conversations on an opaque
  conversation_id and adds title + created_at, so one persona can hold any
  number of separate threads. Every DAO read and write is scoped by user_id
  as well: a conversation id is a bearer token for someone's transcript and
  must never grant access on its own.
- The per-conversation lock and in-flight turn slot key on conversation_id,
  so two threads with the same persona can run turns concurrently.

Endpoints
- POST/DELETE /persona_chat/conversations — start and remove a thread,
  replacing /persona_chat/reset.
- GET /persona_chat/conversations — the chat list, with snippet and counts
  derived from each tree's active branch.
- POST /persona_chat/rewind, POST /persona_chat/switch-branch,
  GET /persona_chat/branches — rewind and fork, mirroring the file chat.
  Index 0 is rewindable here (it is the user's own first question, not a
  synthetic prompt) and re-anchors on the seed node.
- history/turn/rewind/switch-branch/branches all key on conversation_id;
  history gained branch_id and now returns real fork_info, active_leaf_id
  and viewing_branch_id instead of placeholders.

The turn body no longer carries a persona at all — it is read from the
stored conversation, so a stale client cannot swap a thread's voice midway.

Titles
After the first turn persists, the conversation is named from its opening
exchange on the same backend the turn ran on. Small models wrap titles in
quotes, prefix them with "Title:" and append explanations, so sanitize_title
strips all of that and truncates on a character boundary. Any failure falls
back to the user's opening question. Generation runs after persistence: a
failed title must not cost the turn.

Fixes found along the way
- insight_chat: both file-chat turn paths captured path.len() before
  apply_context_budget drained messages out of the middle, then sliced
  messages[path_len..] for the new tree nodes. Once truncation fired that
  dropped the user turn from the tree or panicked on an out-of-range start
  index. Now read after the budget pass as history_len.
- Persona chat had no context budget at all and hardcoded truncated: false
  in the done frame, so a rolling transcript grew unbounded.
- A cancelled turn persisted a half-finished transcript and pushed a second
  terminal frame; it now returns early like the file chat.
- The seeded system prompt was frozen at conversation creation, so editing a
  persona never reached a thread already in flight. Re-resolved per turn.
- turn_count was overwritten each write with the per-turn message delta;
  it is now the cumulative assistant-turn count on the active branch.
- is_initial is always false: the file chat reserves it for its synthetic
  "describe this photo" prompt, and marking a persona chat's first question
  with it made the opening reply impossible to regenerate.

600 lib tests pass, clippy --all-targets clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

migrations/2026-08-25-000000_persona_chat_multi/up.sql

@@ -0,0 +1,50 @@
+-- Multiple conversations per persona.
+--
+-- v1 keyed a transcript on (user_id, persona_id), so a persona had exactly
+-- one rolling conversation and there was no way to start a fresh topic
+-- without discarding the old one. The key is now an opaque `conversation_id`,
+-- with (user_id, persona_id) demoted to an index.
+--
+-- `title` is a short generated summary of the opening exchange, used as the
+-- conversation's name in the list. Empty until the first turn completes; the
+-- client falls back to the persona name while it is blank.
+--
+-- SQLite cannot redefine a primary key in place, so this is the standard
+-- create-copy-drop-rename dance. Existing transcripts carry over with a
+-- generated id and an empty title.
+
+CREATE TABLE persona_chat_conversations_new (
+    conversation_id TEXT NOT NULL PRIMARY KEY,
+    user_id INTEGER NOT NULL,
+    persona_id TEXT NOT NULL,
+    title TEXT NOT NULL DEFAULT '',
+    messages_json TEXT NOT NULL DEFAULT '[]',
+    turn_count INTEGER NOT NULL DEFAULT 0,
+    created_at BIGINT NOT NULL,
+    updated_at BIGINT NOT NULL
+);
+
+INSERT INTO persona_chat_conversations_new (
+    conversation_id, user_id, persona_id, title,
+    messages_json, turn_count, created_at, updated_at
+)
+SELECT
+    lower(hex(randomblob(16))),
+    user_id,
+    persona_id,
+    '',
+    messages_json,
+    turn_count,
+    updated_at,
+    updated_at
+FROM persona_chat_conversations;
+
+DROP INDEX IF EXISTS idx_persona_chat_updated;
+DROP TABLE persona_chat_conversations;
+ALTER TABLE persona_chat_conversations_new RENAME TO persona_chat_conversations;
+
+CREATE INDEX idx_persona_chat_updated
+    ON persona_chat_conversations (user_id, updated_at DESC);
+
+CREATE INDEX idx_persona_chat_persona
+    ON persona_chat_conversations (user_id, persona_id);