Full test suite is now the mandatory final validation; fix everything it surfaced

- Policy: every change ends with make test (all tiers, all tests) green; docs and agent guardrails updated accordingly
- schema.py: ensure the full filtered/indexed column set of instances via get_table (ingress_slug, ports_json, container_gateway, slug, status, ...) so a partial first insert can never break the ingress proxy
- docs_api: award body param location body -> json; gateway endpoints documented public -> user to match enforced auth
- tests: missing get_table import (trash restore), audit read as admin (award), deterministic online-roster and leaderboard-cache handling, container visibility updated to the primary-admin-only rule, scoped AI usage heading selector past the hidden Tools nav links

tests/e2e/admin/aiusage/index.py

@@ -68,4 +68,4 @@ def _seed_target_user():
 def test_admin_ai_usage_page_loads(alice):
     page, _ = alice
     page.goto(f"{BASE_URL}/admin/ai-usage", wait_until="domcontentloaded")
-    assert page.is_visible("text=AI usage") or page.is_visible("text=AI Usage")
+    page.locator("h2:has-text('AI usage')").wait_for(state="visible")