Chat mode, phase 1: grounded streaming chat over your notes

Entry points (no sixth tab): Ask in the Library header (desktop button,
phone icon), Ask about this deck in the deck menu, Ask a question on
study/homework results (compact result travels as context), and a Chat
row in the desktop sidebar. Phones get a full-screen route with back +
New chat; the tab bar steps aside.

- Client-side retrieval: chunk scoped decks (~800 tokens), BM25 against
  the question + recent turns, top chunks under ~7k tokens, each
  labelled with deck + section. Notes come from the deck's stored
  sourceText (already kept for Regenerate); decks without it fall back
  to generated content and the UI says so.
- Stateless server: /api/chat validates against the CHAT_MODELS
  allowlist, trims the history to ~6k tokens, caps context at ~9k and
  streams token/thinking/done/error NDJSON. /api/chat/extract reduces
  attachments to text through the existing vision step.
- UI: user bubbles + full-width assistant text, streaming with stop,
  auto-scroll that pauses with a jump-to-bottom button, safe markdown
  (React nodes, no HTML injection; KaTeX dynamically imported only when
  a message has math), Thinking row for reasoning, copy/regenerate/
  edit-and-resend, model + context pickers (last model remembered),
  composer with visualViewport keyboard handling, safe-area, 16px
  textarea, Enter-to-send on desktop.
- Usage-limit failures keep the draft and show the shared message with
  Settings/Ollama actions; stopping maps the reader abort to a clean
  stopped state; offline disables sending with a reason.
- Settings: Keep notes text for chat toggle; deck menu: Delete notes
  text. RATE_LIMIT_CHAT + CHAT_MODELS in .env.example and README.
- Tests: chat suite (63 checks, stub Ollama) wired into run-all.
  Full set: 12/12 suites, 487 checks. SW -> freezmo-v32.

Also: tests/model-compare.mjs (diagnostic) benchmarks two models on the
same notes (latency, repair rounds, activity types) so the gpt-oss vs
gemma default can be decided on numbers; defaults unchanged.

lib/config.ts

@@ -17,6 +17,8 @@ export type ServerConfig = {
   authMode: AuthMode;
   visionModel: string;
   textModel: string;
+  /** Allowlist for the chat model picker (CHAT_MODELS). Never client-supplied. */
+  chatModels: string[];
   /** True when talking straight to https://ollama.com (needs an API key). */
   directCloud: boolean;
   timeoutMs: number;
@@ -33,6 +35,7 @@ export type ServerConfig = {
     refine: number;
     sync: number;
     push: number;
+    chat: number;
   };
   sync: {
     /** Where opaque encrypted sync blobs live (SYNC_DIR). */
@@ -100,12 +103,31 @@ export function getServerConfig(): ServerConfig {
     10,
   );
 
+  const visionModel = process.env.VISION_MODEL?.trim() || "gemma4:31b-cloud";
+  const textModel = process.env.TEXT_MODEL?.trim() || "gpt-oss:120b-cloud";
+
+  // Chat model allowlist: CHAT_MODELS wins, otherwise the configured text and
+  // vision models. Dedupe on the canonical name so `x` and `x:cloud` collapse.
+  const requestedChatModels = (process.env.CHAT_MODELS ?? "")
+    .split(",")
+    .map((entry) => entry.trim())
+    .filter(Boolean);
+  const chatModels: string[] = [];
+  const seenModels = new Set<string>();
+  for (const entry of requestedChatModels.length > 0 ? requestedChatModels : [textModel, visionModel]) {
+    const canonical = canonicalModelName(entry);
+    if (seenModels.has(canonical)) continue;
+    seenModels.add(canonical);
+    chatModels.push(entry);
+  }
+
   return {
     baseUrl,
     apiKey,
     authMode,
-    visionModel: process.env.VISION_MODEL?.trim() || "gemma4:31b-cloud",
-    textModel: process.env.TEXT_MODEL?.trim() || "gpt-oss:120b-cloud",
+    visionModel,
+    textModel,
+    chatModels,
     directCloud,
     timeoutMs: Number.parseInt(process.env.OLLAMA_TIMEOUT_MS ?? "", 10) || 300_000,
     healthTimeoutMs:
@@ -125,6 +147,8 @@ export function getServerConfig(): ServerConfig {
       sync: positiveInt(process.env.RATE_LIMIT_SYNC, 60),
       // Push subscription changes and test sends.
       push: positiveInt(process.env.RATE_LIMIT_PUSH, 30),
+      // Chat turns are one model call each, but users send them in bursts.
+      chat: positiveInt(process.env.RATE_LIMIT_CHAT, 60),
     },
     sync: {
       dir: process.env.SYNC_DIR?.trim() || path.join(process.cwd(), ".freezmo", "sync"),