feat: let one source carry several chats, and open them with a +

A source had exactly one live conversation, so the copilot could only ever
replace a chat, never add one: the trash button reset the source and the old
conversation was left orphaned. Working on two things at once meant losing one.

The tab bar now holds two kinds of tab. A primary tab is a source — it shows
whatever `web` or `project-7` currently points at, which is where background
delivery lands (notify, a finished async task, an inbound Telegram message) and
what a reset moves to a fresh row. A secondary tab, opened with `+`, is one
specific conversation: its source points elsewhere, so it is unreachable by
source name and is addressed by id throughout — REST, WebSocket, event
filtering. `POST /api/sessions/new` creates one without touching `sources`,
which is the whole difference from a reset; its agent and run-context still come
from the source, so an extra project tab is the coordinator with the project's
context. Project "Open chat" is untouched and still resumes the project's own.

The load-bearing half is in ChatHub: the input queue and the model pin are now
keyed by session, not by source. Two tabs on one source would otherwise
serialize into a single queue and a single turn, and share a `/model` pin — the
odd one out, since the security group was already per-session and persisted. The
source-taking methods survive as one-line resolvers, so Telegram, mobile and
cron are untouched. Because queues now grow with conversations rather than with
the handful of sources, a reset retires the queue it replaces instead of leaving
a consumer task parked forever.

Events are filtered per conversation, so anything a chat must see has to carry a
session id: `show_file_to_user`'s OpenFile and the security-group revalidation
were emitting untagged and would have reached nobody. A primary connection
additionally follows NewSession for its source, so a second window does not keep
talking to a conversation another window just reset.

Tabs can be renamed by double-click — `chat_sessions.title` existed and was dead
until now. An empty name stores NULL, so the box is also the undo.

crates/skald-core/src/db/chat_sessions.rs

@@ -79,6 +79,18 @@ pub async fn set_open(pool: &SqlitePool, id: i64, open: bool) -> anyhow::Result<
     Ok(())
 }
 
+/// Rename a conversation. An empty title is stored as `NULL`, so clearing the
+/// box gives back the automatic label rather than a blank tab.
+pub async fn set_title(pool: &SqlitePool, id: i64, title: Option<&str>) -> anyhow::Result<()> {
+    let title = title.map(str::trim).filter(|t| !t.is_empty());
+    sqlx::query("UPDATE chat_sessions SET title = ? WHERE id = ?")
+        .bind(title)
+        .bind(id)
+        .execute(pool)
+        .await?;
+    Ok(())
+}
+
 /// The tabs to restore, in creation order so the bar keeps a stable layout.
 pub async fn list_open(pool: &SqlitePool) -> anyhow::Result<Vec<OpenSession>> {
     let rows = sqlx::query_as::<_, (i64, String, Option<String>)>(
@@ -146,4 +158,39 @@ mod tests {
         assert!(find_by_id(&pool, b.id).await.unwrap().is_some());
         assert!(find_by_id(&pool, a.id).await.unwrap().is_some());
     }
+
+    /// One source, two open conversations — the shape the copilot's `+` produces
+    /// and the one the old per-source model could not express. Order is by id, so
+    /// the bar lays out the same way on every device.
+    #[tokio::test]
+    async fn a_source_can_hold_several_open_conversations() {
+        let pool = owner_pool().await;
+        let mut ids = Vec::new();
+        for _ in 0..3 {
+            let s = create(&pool, "assistant", "web", true, false).await.unwrap();
+            set_open(&pool, s.id, true).await.unwrap();
+            ids.push(s.id);
+        }
+        let open = list_open(&pool).await.unwrap();
+        assert_eq!(open.iter().map(|s| s.id).collect::<Vec<_>>(), ids);
+    }
+
+    /// Clearing the name gives back the automatic label instead of a blank tab, so
+    /// the rename box is also how a rename is undone. Whitespace counts as empty.
+    #[tokio::test]
+    async fn an_empty_title_clears_the_name() {
+        let pool = owner_pool().await;
+        let s = create(&pool, "assistant", "web", true, false).await.unwrap();
+        set_open(&pool, s.id, true).await.unwrap();
+
+        set_title(&pool, s.id, Some("  Trip planning  ")).await.unwrap();
+        assert_eq!(list_open(&pool).await.unwrap()[0].title.as_deref(), Some("Trip planning"));
+
+        set_title(&pool, s.id, Some("   ")).await.unwrap();
+        assert!(list_open(&pool).await.unwrap()[0].title.is_none());
+
+        set_title(&pool, s.id, Some("Named again")).await.unwrap();
+        set_title(&pool, s.id, None).await.unwrap();
+        assert!(list_open(&pool).await.unwrap()[0].title.is_none());
+    }
 }