Full test suite is now the mandatory final validation; fix everything it surfaced

- Policy: every change ends with make test (all tiers, all tests) green; docs and agent guardrails updated accordingly
- schema.py: ensure the full filtered/indexed column set of instances via get_table (ingress_slug, ports_json, container_gateway, slug, status, ...) so a partial first insert can never break the ingress proxy
- docs_api: award body param location body -> json; gateway endpoints documented public -> user to match enforced auth
- tests: missing get_table import (trash restore), audit read as admin (award), deterministic online-roster and leaderboard-cache handling, container visibility updated to the primary-admin-only rule, scoped AI usage heading selector past the hidden Tools nav links

tests/api/profile/award.py

@@ -2,10 +2,8 @@
 
 import time
 import requests
-from datetime import datetime, timezone
 from tests.conftest import BASE_URL
 from devplacepy.db_client import get_table
-from devplacepy.utils import generate_uid, make_combined_slug
 
 JSON = {"Accept": "application/json"}
 _counter = [0]
@@ -177,7 +175,7 @@ def test_valid_post_creates_pending_row_and_job(app_server):
     assert job and job.get("kind") == "award"
 
 
-def test_award_give_audit_recorded(app_server):
+def test_award_give_audit_recorded(app_server, seeded_db):
     giver, _ = _signup()
     _, receiver_name = _signup()
     r = giver.post(
@@ -186,5 +184,6 @@ def test_award_give_audit_recorded(app_server):
         json={"description": "Audit me"},
     )
     assert r.status_code == 200
-    entry = _audit_find(giver, "award.give", _uid(receiver_name))
+    admin = _login(seeded_db, "alice")
+    entry = _audit_find(admin, "award.give", _uid(receiver_name))
     assert entry is not None