feat: add per-user avatar seed regeneration with irreversible random avatar replacement

Implement a new `avatar_seed` column on the users table that overrides the username-based seed for Multiavatar generation. Introduce a null-safe `avatar_seed(user)` choke point in `avatar.py` that resolves `user.get("avatar_seed") or user.get("username")`, registered as a Jinja global so every render site (`_avatar_link.html`, `avatar_url(...)` calls, SEO `og_image`, issues ad-hoc dicts, devRant payload/PNG) propagates a regenerated seed. Add `POST /profile/{username}/regenerate-avatar` endpoint (owner-or-admin only) that writes a fresh `generate_uid()` to `avatar_seed`, invalidates the target's user cache, and audits `profile.avatar.regenerate`. The previous seed is overwritten and never stored, making regeneration irreversible. Document the feature in `AGENTS.md` and `README.md`, add the API endpoint to `docs_api.py`, and include the `regenerate_avatar` Devii tool in `CONFIRM_REQUIRED`.

devplacepy/services/devii/actions/catalog.py

@@ -724,6 +724,21 @@ ACTIONS: tuple[Action, ...] = (
             ),
         ),
     ),
+    Action(
+        name="regenerate_avatar",
+        method="POST",
+        path="/profile/{username}/regenerate-avatar",
+        summary="Generate a new random avatar for a user",
+        description=(
+            "Replaces the user's avatar with a freshly generated random one and returns the new "
+            "avatar_url. Owner-or-admin only. Irreversible: the previous avatar is gone for good, "
+            "so confirm with the user before calling it."
+        ),
+        params=(
+            path("username", "Username whose avatar to regenerate."),
+            confirm(),
+        ),
+    ),
     Action(
         name="list_messages",
         method="GET",
@@ -1937,7 +1952,7 @@ ACTIONS: tuple[Action, ...] = (
         name="game_steal",
         method="POST",
         path="/game/farm/{username}/steal",
-        summary="Steal a ready build from another player's Code Farm once its 60s protection window has passed",
+        summary="Steal a ready build from another player's Code Farm once its protection window has passed (limited to once per hour per neighbour)",
         handler="http",
         requires_auth=True,
         params=(
@@ -1949,7 +1964,7 @@ ACTIONS: tuple[Action, ...] = (
         name="game_fertilize",
         method="POST",
         path="/game/fertilize",
-        summary="Spend coins to halve a growing build's remaining time on your Code Farm",
+        summary="Spend coins to halve a growing build's remaining time on your Code Farm (cost scales with the build's harvest value, so it is a pure time-skip, never a profit)",
         handler="http",
         requires_auth=True,
         params=(
@@ -1990,10 +2005,25 @@ ACTIONS: tuple[Action, ...] = (
         name="game_prestige",
         method="POST",
         path="/game/prestige",
-        summary="Refactor (prestige) your Code Farm for a permanent coin bonus (requires level 10)",
+        summary="Refactor (prestige) your Code Farm for a permanent coin bonus and Stars (requires level 10)",
         handler="http",
         requires_auth=True,
     ),
+    Action(
+        name="game_upgrade_legacy",
+        method="POST",
+        path="/game/legacy",
+        summary="Spend Stars on a permanent Legacy upgrade that survives refactor (autoharvest, multiplier, speed, plots, defense)",
+        handler="http",
+        requires_auth=True,
+        params=(
+            body(
+                "key",
+                "Legacy key: autoharvest, multiplier, speed, plots, or defense.",
+                required=True,
+            ),
+        ),
+    ),
 )
 
 PLATFORM_CATALOG = Catalog(actions=ACTIONS)

devplacepy/services/devii/actions/dispatcher.py

@@ -41,6 +41,7 @@ CONFIRM_REQUIRED = {
     "delete_project",
     "delete_media",
     "regenerate_api_key",
+    "regenerate_avatar",
     "delete_post",
     "delete_comment",
     "delete_gist",