chore: add agents/reports to gitignore and update agent infrastructure with timestamp streaming, write budget, and codename generation

- Add `agents/reports/` to `.gitignore` to prevent generated agent report files from being tracked
- Implement `_TimestampStream` class and `install_timestamps()` function in `agents/agent.py` for prefixing stdout/stderr with timestamps and elapsed time
- Export `install_timestamps`, `set_write_budget`, `clear_write_budget`, and `set_shell_restricted` from `agents/base.py`; add `_RUN_LOCK`, `AGENT_ICONS` dictionary, and `WRITE_BUDGET = 20` constant
- Add `report_codename()` function and `CODENAME_ADJECTIVES`/`CODENAME_ANIMALS` tuples to `agents/core/__init__.py` for generating random agent report codenames
- Expand `WRITE_TOOLS` tuple in `agents/core/__init__.py` to include `replace_lines`, `insert_lines`, and `delete_lines`; remove `SWARM_TOOLS` from `payloads_for` exclusion list
- Update `CLAUDE.md` and `AGENTS.md` documentation with dataset column initialization rules and new agent infrastructure details
- Reorder route table in `README.md` to list `/uploads` before `/messages` and document Swagger/ReDoc/OpenAPI schema endpoints

CLAUDE.md

@@ -119,7 +119,7 @@ Docs (`routers/docs.py` `DOCS_PAGES`) entries take optional `admin: True` (hidde
 Session cookies named `session`, value is a 64-char hex token from `secrets.token_hex(32)`. Passwords hashed with `pbkdf2_sha256` via passlib. `get_current_user(request)` returns user dict or `None`, with a per-process TTL cache (`_user_cache`, 300s) keyed by token. `require_user(request)` raises a 303 redirect to `/` for guests; `require_admin(request)` redirects to `/feed` for non-admins. Public pages (feed, news detail, project detail, gists) use `get_current_user` so guests can browse - POSTs are all guarded by `require_user`.
 
 ### Database (`devplacepy/database.py`)
-SQLite via `dataset.connect` with WAL + 30s busy timeout + 256MB mmap. `init_db()` is idempotent - every index is created via `CREATE INDEX IF NOT EXISTS` wrapped in try/except, and seed defaults for `site_settings` only insert when the key doesn't already exist.
+SQLite via `dataset.connect` with WAL + 30s busy timeout + 256MB mmap. `init_db()` is idempotent - every index is created via `CREATE INDEX IF NOT EXISTS` wrapped in try/except, and seed defaults for `site_settings` only insert when the key doesn't already exist. **`init_db()` also ensures the full column set of any table that code filters on** (`news`, `news_sync`, `attachments` use `get_table(name)` + `create_column_by_example` before their indexes). This is mandatory, not optional: dataset gives a lazily-created table ONLY the columns of its first insert, so a partial insert from a CLI tool/test/maintenance script would otherwise create the table with a reduced schema, and the long-running server caches that stale schema - making later queries on the missing column 500 with `no such column`. When adding a new filtered/indexed column, add it to the matching `init_db()` ensure-block (see `AGENTS.md` -> "Dataset rules -> `init_db()` MUST create every queried column").
 
 **SQLite is synchronous by design and will never be made async (hard rule).** The `dataset`/SQLite layer is synchronous and is called directly inside the async route handlers. This is intentional and more than fast enough for this platform: the database is a local file tuned with WAL, `synchronous=NORMAL`, a 30s busy timeout, an 8MB page cache, and a 256MB mmap, so queries are sub-millisecond and never meaningfully stall the event loop. Do NOT convert the database layer to async, do NOT wrap DB calls in a threadpool/`run_in_executor`/`to_thread`, and do NOT raise the synchronous DB access as a performance, blocking-I/O, or "requests aren't fully async" concern. This is a settled, sophisticated design choice and is not open for revisiting.
 
@@ -191,7 +191,7 @@ The profile **Media** tab lists every attachment a user uploaded (`get_user_medi
 
 ## Testing
 
-Playwright (NOT pytest-playwright - uninstall if present, it conflicts). 419 tests across 34 files in `tests/` (mixed Playwright UI tests and in-process `TestClient`/asyncio unit tests). The fixture stack:
+Playwright (NOT pytest-playwright - uninstall if present, it conflicts). 849+ tests across 63 files in `tests/` (mixed Playwright UI tests and in-process `TestClient`/asyncio unit tests). The fixture stack:
 
 - `app_server` (session-scoped): spawns uvicorn as a subprocess on `_xdist_port()` (10501 + worker index) with a tempfile DB.
 - `browser_context` (session-scoped): one Playwright context shared by all tests.
@@ -250,7 +250,7 @@ Read the router (`routers/{area}.py`), template (`templates/{area}.html`), test
 
 ## Maintenance agents and validation
 
-The `agents/` directory is a fleet of autonomous AI maintenance agents (developer tooling, not part of the running app). Each agent enforces one quality dimension across the repo and runs in `--fix` (default) or `--check` mode. The full design is in `agents.md`; the public docs are `/docs/maintenance-agents.html` and `/docs/maintenance-usage.html`. Targets: `make <name>-agent` (`CHECK=1` for report-only), `make agents-all`, `make maestro`.
+The `agents/` directory is a fleet of autonomous AI maintenance agents (developer tooling, not part of the running app). Each agent enforces one quality dimension across the repo and runs in `--fix` (default) or `--check` mode. The internals are documented in `AGENTS.md` (the "Maintenance agents" section); the public docs are `/docs/maintenance-agents.html` and `/docs/maintenance-usage.html`. Targets: `make <name>-agent` (`CHECK=1` for report-only), `make agents-all`, `make maestro`.
 
 **HARD RULE - the `agents/` directory is OFF-LIMITS to every code checker, fixer, linter, style pass, or refactor, including the maintenance agents themselves, Claude, and any other tool or human cleanup.** That directory deliberately contains the exact patterns the agents hunt for - em-dash characters, forbidden-name examples (`_temp`, `_v2`, `my_`), destructive-command strings (`rm -rf`), and HTML entities - as DETECTION DATA, not as violations. "Fixing" them corrupts the detectors and breaks the fleet. The maintenance agents enforce this themselves: every run calls `agent.protect_agents()`, which makes the engine's write tools (`write_file`/`edit_file`/`patch_file`/`create_file`) hard-reject any path under `agents/`, and their system prompt forbids reading or scanning it. Do NOT em-dash-strip, rename, reformat, or otherwise "tidy" anything in `agents/`. Leave it exactly as authored.