feat: per-conversation project binding + action-tool consent gate

- Conversations bind to a project on creation; RAG scopes to the
  conversation's project, not the global setting.
- Action tools (web_search/fetch_url/remember) are withheld unless
  allow_action_tools is enabled (off by default). Settings toggle.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_documents.py

@@ -57,6 +57,17 @@ def test_search_empty_query_returns_nothing():
     assert asyncio.run(s.search_documents("", _fake_embed)) == []
 
 
+def test_conversation_project_binding():
+    s = _store()
+    assert s.conversation_project("nope") is None      # not created yet
+    s.create_conversation("c1", "projX")
+    assert s.conversation_project("c1") == "projX"
+    s.create_conversation("c1", "other")               # idempotent: keeps projX
+    assert s.conversation_project("c1") == "projX"
+    s.create_conversation("c2")
+    assert s.conversation_project("c2") == ""           # unscoped
+
+
 def test_conversation_recall_uses_vec_and_matches_brute_force():
     s = _store()
     if not s.vec_enabled: