Full test suite is now the mandatory final validation; fix everything it surfaced

- Policy: every change ends with make test (all tiers, all tests) green; docs and agent guardrails updated accordingly
- schema.py: ensure the full filtered/indexed column set of instances via get_table (ingress_slug, ports_json, container_gateway, slug, status, ...) so a partial first insert can never break the ingress proxy
- docs_api: award body param location body -> json; gateway endpoints documented public -> user to match enforced auth
- tests: missing get_table import (trash restore), audit read as admin (award), deterministic online-roster and leaderboard-cache handling, container visibility updated to the primary-admin-only rule, scoped AI usage heading selector past the hidden Tools nav links

tests/api/projects/containers/data.py

@@ -3,7 +3,7 @@
 import time
 import requests
 from tests.conftest import BASE_URL
-from devplacepy.database import get_table
+from devplacepy.database import get_primary_admin_uid, get_table, invalidate_admins_cache
 from devplacepy.utils import clear_user_cache
 
 _counter_cv = [0]
@@ -70,11 +70,14 @@ def test_admin_private_project_containers_hidden_from_other_admin(app_server):
     assert _containers_data_status(owner_key, slug) == 200
 
 
-def test_member_private_project_containers_visible_to_admin(app_server):
+def test_member_private_project_containers_primary_admin_only(app_server):
     _, _, owner_key = _signup()
     _, _, admin_key = _make_admin()
     slug = _create_project(owner_key, "Member Container Hidden", is_private=True)
-    assert _containers_data_status(admin_key, slug) == 200
+    assert _containers_data_status(admin_key, slug) == 404
+    invalidate_admins_cache()
+    primary_key = get_table("users").find_one(uid=get_primary_admin_uid())["api_key"]
+    assert _containers_data_status(primary_key, slug) == 200
 
 
 def test_public_project_containers_visible_to_any_admin(app_server):