feat(learn): conversations with assistants, kept sealed (ADR 0021, step 3)

The first part of step 3, decided as D47 to D52 in ADR 0021: where a
conversation shows (a sheet over the screen), where kept ones are found
(the field), the scope's chip and that it starts with only what is
ticked, how conversations are kept, and what a device that can't seal
does.

Two synced tables: assistant_conversation (its title, assistant and
scope) and assistant_turn (one question and everything up to its answer,
never changed once written, ADR 0001, rule 2), so two devices continuing
a conversation offline lose nothing. SyncConversationGateway seals every
row with the person's key, a turn bound to its conversation, and reads
no row that isn't sealed: a device that can't seal keeps nothing (D52,
ConversationNotKept). Deleting one blanks it and its turns first (ADR
0002, rule 2). A turn keeps every message a follow-up sends back (tool
calls and results, the providers' own blocks), but no image, only that
one was sent.

The instance's privacy page says conversations are kept, encrypted, and
what the instance sees of them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0021-private-instance-and-assistant.md

@@ -5,7 +5,7 @@
   keeps and does, where it lives, the proposal's points 4–8 and 10, how often it warns and
   when it is built (D13–D18), who signs up and who operates (D19–D22), waiting accounts
   (D23–D26), what people are told and what never goes (D27–D30), how the first step is
-  built (D31–D34) and the second (D35–D46).
+  built (D31–D34), the second (D35–D46) and the third (D47–).
 - **Builds on:** ADR 0016 (the register), ADR 0019 (private studysets), ADR 0020
   (SimpleLogin), ADR 0022 (the hand-off and the connector gone).
 - **Changes:** the rule of 10 Oct 2026 that Halkyon calls no language model with an API
@@ -307,6 +307,34 @@ On 25 Oct, how the second step is built (the assistants, their grants and figure
   streamed them, sent back in their place (as Anthropic's thinking blocks are), and the
   `phase` of its messages. Ollama, vLLM and OpenRouter speak it as well.
 
+On 26 Oct, how the third step is built (the assistant answering in Learn):
+
+- **D47 A conversation shows in a sheet over the screen it was asked on** (recommended,
+  over a screen of its own and over the answer unfolding under the field): at half
+  height, dragged up to full, follow-up questions in the same sheet, so the card in a
+  session or the studyset asked about stays in view.
+- **D48 Kept conversations are found from the field** (recommended, over a tile in
+  Settings › Assistants and over both): a history button in the field lists them, newest
+  first, each with its assistant and scope, those about where the person is first;
+  deleting one asks first.
+- **D49 The scope is one chip with a menu** (recommended, over a segmented row of the
+  four): it leads the parts' chips ("Only what I tick"), and its menu holds This
+  studyset, Its tree, Library and D8's switch, so the field takes one more line at most.
+- **D50 The field starts with only what is ticked** (recommended, over where the person
+  is and over the last scope used): nothing goes beyond the chips ticked and the model
+  gets no lookups until the person widens the scope, as the chips themselves start
+  unticked (decided 10 Oct).
+- **D51 A conversation is a row and its turns, appended** (recommended, over one row
+  rewritten per conversation): `assistant_conversation` holds its assistant, scope and
+  title, `assistant_turn` one turn each, never changed once written (ADR 0001, rule 2), so
+  two devices continuing it offline lose nothing, and each turn is sealed alone (D13), so
+  a long conversation isn't sealed and synced anew with every question. Deleting one
+  blanks its turns, then deletes them (ADR 0002, rule 2).
+- **D52 A device that can't seal answers but keeps nothing** (recommended, over offering
+  no assistant there): where the account's keys aren't open, the sheet says the
+  conversation isn't kept, and it is gone once the sheet closes; nothing unsealed is
+  stored or synced, as with own keys.
+
 ## Proposal
 
 1. **Who signs up, per instance:** `SIGN_UP`: `open` (as today), `approval`, or