Full test suite is now the mandatory final validation; fix everything it surfaced

- Policy: every change ends with make test (all tiers, all tests) green; docs and agent guardrails updated accordingly
- schema.py: ensure the full filtered/indexed column set of instances via get_table (ingress_slug, ports_json, container_gateway, slug, status, ...) so a partial first insert can never break the ingress proxy
- docs_api: award body param location body -> json; gateway endpoints documented public -> user to match enforced auth
- tests: missing get_table import (trash restore), audit read as admin (award), deterministic online-roster and leaderboard-cache handling, container visibility updated to the primary-admin-only rule, scoped AI usage heading selector past the hidden Tools nav links

devplacepy/database/schema.py

@@ -358,6 +358,21 @@ def init_db():
     _index(
         db, "issue_comment_authors", "idx_issue_comment_authors_number", ["gitea_number"]
     )
+
+    ws_tickets = get_table("ws_tickets")
+    for column, example in (
+        ("uid", ""),
+        ("token", ""),
+        ("user_uid", ""),
+        ("created_at", ""),
+        ("expires_at", ""),
+        ("used_at", ""),
+    ):
+        if not ws_tickets.has_column(column):
+            ws_tickets.create_column_by_example(column, example)
+    _index(db, "ws_tickets", "idx_ws_tickets_token", ["token"], unique=True)
+    _index(db, "ws_tickets", "idx_ws_tickets_expires", ["expires_at"])
+
     migrate_bug_tables_to_issue_tables()
     _index(db, "service_state", "idx_service_state_name", ["name"])
     if "devii_conversations" in db.tables:
@@ -471,16 +486,26 @@ def init_db():
     _index(db, "jobs", "idx_jobs_expires", ["expires_at"])
     _index(db, "project_forks", "idx_project_forks_source", ["source_project_uid"])
     _index(db, "project_forks", "idx_project_forks_forked", ["forked_project_uid"])
-    if "instances" in db.tables:
-        instances = get_table("instances")
-        for column, example in (
-            ("run_as_uid", ""),
-            ("boot_language", "none"),
-            ("boot_script", ""),
-            ("start_on_boot", 0),
-        ):
-            if not instances.has_column(column):
-                instances.create_column_by_example(column, example)
+    instances = get_table("instances")
+    for column, example in (
+        ("uid", ""),
+        ("project_uid", ""),
+        ("slug", ""),
+        ("name", ""),
+        ("status", ""),
+        ("desired_state", ""),
+        ("container_id", ""),
+        ("ingress_slug", ""),
+        ("ingress_port", 0),
+        ("ports_json", ""),
+        ("container_gateway", ""),
+        ("run_as_uid", ""),
+        ("boot_language", "none"),
+        ("boot_script", ""),
+        ("start_on_boot", 0),
+    ):
+        if not instances.has_column(column):
+            instances.create_column_by_example(column, example)
 
     _index(db, "instances", "idx_instances_project", ["project_uid"])
     _index(db, "instances", "idx_instances_slug", ["slug"])