feat(groups): a group becomes somewhere you can go

It was a heading over some rows: a name, a colour, and whether it was folded.
Enough to tidy a list, and not enough to be what people mean by it — "Arbejde" is
a body of work with context of its own, and documents that belong to all of it
rather than to any one project inside it.

`/gruppe/{id}` carries three things a heading cannot. The projects in it, each
with what is still open — open tasks, not all of them, because "12" beside a
project somebody finished last year is a number that means nothing. A description,
written in place and saved on blur, the same shape a task's description has. And
the files that govern the whole group: the contract, the drawing, the agreement
everything else rests on.

The name in the sidebar is a link to it and the chevron beside it still folds.
Two intentions, two targets — the single one they used to share could only ever
serve the smaller.

Migration 0012 rebuilds `attachments`, because its CHECK spelled out exactly which
parent columns may be set and SQLite cannot alter a CHECK. The rule is still
"exactly one parent", counted rather than written out as pairwise comparisons:
with three columns that is three clauses, with four it is six, and the version
that is wrong looks exactly like the one that is right.

A group's file is reachable by its owner and nobody else. A group belongs to one
person and is never shared, so `reachAttachment` asks about ownership rather than
a project role — both old callers resolved straight to a task, so a group's
attachment answered 404 for the person who uploaded it.

Three tests also stopped racing their own navigation. Creating a project navigates
and `goto` is a promise nobody was holding, so a quick add fired straight after
could land in the Inbox instead — intermittent, and it read as the quick add
having failed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/store/comments.go

@@ -21,9 +21,12 @@ type Comment struct {
 }
 
 type Attachment struct {
-	ID         string
-	TaskID     string
-	CommentID  string
+	ID        string
+	TaskID    string
+	CommentID string
+	// GroupID hangs the file on a project group rather than on any one task in
+	// it: the contract that governs all of "Arbejde", not a step in it.
+	GroupID    string
 	Filename   string
 	MimeType   string
 	Size       int64
@@ -154,17 +157,17 @@ func (db *DB) CreateAttachment(ctx context.Context, a *Attachment) error {
 	a.CreatedAt = time.Now().UTC()
 
 	_, err := db.ExecContext(ctx,
-		`INSERT INTO attachments (id, task_id, comment_id, filename, mime_type, size,
-		                          path, uploaded_by, created_at)
-		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-		a.ID, nullString(a.TaskID), nullString(a.CommentID), a.Filename,
-		a.MimeType, a.Size, a.Path, a.UploadedBy, a.CreatedAt.Unix())
+		`INSERT INTO attachments (id, task_id, comment_id, group_id, filename, mime_type,
+		                          size, path, uploaded_by, created_at)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		a.ID, nullString(a.TaskID), nullString(a.CommentID), nullString(a.GroupID),
+		a.Filename, a.MimeType, a.Size, a.Path, a.UploadedBy, a.CreatedAt.Unix())
 	return err
 }
 
 func (db *DB) ListTaskAttachments(ctx context.Context, taskID string) ([]Attachment, error) {
 	rows, err := db.QueryContext(ctx,
-		`SELECT id, task_id, comment_id, filename, mime_type, size, path, uploaded_by, created_at
+		`SELECT id, task_id, comment_id, group_id, filename, mime_type, size, path, uploaded_by, created_at
 		 FROM attachments WHERE task_id = ? ORDER BY created_at`, taskID)
 	if err != nil {
 		return nil, err
@@ -173,13 +176,26 @@ func (db *DB) ListTaskAttachments(ctx context.Context, taskID string) ([]Attachm
 	return scanAttachments(rows)
 }
 
+// ListGroupAttachments is the documents that belong to a whole group rather than
+// to anything inside it.
+func (db *DB) ListGroupAttachments(ctx context.Context, groupID string) ([]Attachment, error) {
+	rows, err := db.QueryContext(ctx,
+		`SELECT id, task_id, comment_id, group_id, filename, mime_type, size, path, uploaded_by, created_at
+		 FROM attachments WHERE group_id = ? ORDER BY created_at`, groupID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	return scanAttachments(rows)
+}
+
 func (db *DB) attachmentsByComment(ctx context.Context, commentIDs []string) (map[string][]Attachment, error) {
 	args := make([]any, len(commentIDs))
 	for i, id := range commentIDs {
 		args[i] = id
 	}
 	rows, err := db.QueryContext(ctx,
-		`SELECT id, task_id, comment_id, filename, mime_type, size, path, uploaded_by, created_at
+		`SELECT id, task_id, comment_id, group_id, filename, mime_type, size, path, uploaded_by, created_at
 		 FROM attachments WHERE comment_id IN (`+placeholders(len(commentIDs))+`)
 		 ORDER BY created_at`, args...)
 	if err != nil {
@@ -202,14 +218,15 @@ func scanAttachments(rows *sql.Rows) ([]Attachment, error) {
 	out := []Attachment{}
 	for rows.Next() {
 		var a Attachment
-		var taskID, commentID sql.NullString
+		var taskID, commentID, groupID sql.NullString
 		var created int64
-		if err := rows.Scan(&a.ID, &taskID, &commentID, &a.Filename, &a.MimeType,
+		if err := rows.Scan(&a.ID, &taskID, &commentID, &groupID, &a.Filename, &a.MimeType,
 			&a.Size, &a.Path, &a.UploadedBy, &created); err != nil {
 			return nil, err
 		}
 		a.TaskID = taskID.String
 		a.CommentID = commentID.String
+		a.GroupID = groupID.String
 		a.CreatedAt = time.Unix(created, 0).UTC()
 		out = append(out, a)
 	}
@@ -218,7 +235,7 @@ func scanAttachments(rows *sql.Rows) ([]Attachment, error) {
 
 func (db *DB) GetAttachment(ctx context.Context, attachmentID string) (*Attachment, error) {
 	rows, err := db.QueryContext(ctx,
-		`SELECT id, task_id, comment_id, filename, mime_type, size, path, uploaded_by, created_at
+		`SELECT id, task_id, comment_id, group_id, filename, mime_type, size, path, uploaded_by, created_at
 		 FROM attachments WHERE id = ?`, attachmentID)
 	if err != nil {
 		return nil, err