feat(assistant): trip assistant chat with your own AI connection

Adds an in-app assistant that reads and plans the open trip. Users connect
their own provider (Sign in with ChatGPT, or an Anthropic, OpenAI, Gemini or
OpenRouter key) or use the one the admin set up, including a custom
OpenAI-compatible server. It is an addon and only shows while a connection
is usable.

The chat runs on the existing MCP tools, pinned to the trip. Every change is
held as a change card the user applies or discards, and applied changes can
be undone. On the desktop it is a floating window that can be moved and
resized; on the phone it is fullscreen. Search results show as place cards
that can go onto a day, weather lookups as a strip, proposed places as
ghost markers on the map with a before/after switch, and an answer can be
shared into the trip chat. Booking files can be dropped in and are read
into change cards.

server/scripts/migrate-encryption.ts

@@ -634,6 +634,26 @@ async function main() {
       }
     }
 
+    // --- ai_connections: secrets ---
+    // The AI assistant's connections keep their credential in ONE encrypted
+    // JSON blob (src/nest/ai-connections/ai-secrets.ts): an API key, or a
+    // ChatGPT sign-in's tokens. Left out of a rotation, the instance's
+    // connection asks the admin for its key again and every ChatGPT user has
+    // to sign in anew. The table arrived with a later migration, hence the
+    // existence check.
+    if (tableExists('ai_connections')) {
+      const aiConnections = db.prepare('SELECT id, secrets FROM ai_connections WHERE secrets IS NOT NULL').all() as {
+        id: number;
+        secrets: string;
+      }[];
+      for (const row of aiConnections) {
+        const newVal = migrateApiKeyValue(row.secrets, `ai_connections[${row.id}].secrets`);
+        if (newVal !== null) {
+          db.prepare('UPDATE ai_connections SET secrets = ? WHERE id = ?').run(newVal, row.id);
+        }
+      }
+    }
+
     // --- trip_document_links: webhook_secret ---
     // The secret a provider signs its webhook calls with, stored through the
     // same blob helper. It is written once when the link is created and never