feat: add per-user avatar seed regeneration with irreversible random avatar replacement

Implement a new `avatar_seed` column on the users table that overrides the username-based seed for Multiavatar generation. Introduce a null-safe `avatar_seed(user)` choke point in `avatar.py` that resolves `user.get("avatar_seed") or user.get("username")`, registered as a Jinja global so every render site (`_avatar_link.html`, `avatar_url(...)` calls, SEO `og_image`, issues ad-hoc dicts, devRant payload/PNG) propagates a regenerated seed. Add `POST /profile/{username}/regenerate-avatar` endpoint (owner-or-admin only) that writes a fresh `generate_uid()` to `avatar_seed`, invalidates the target's user cache, and audits `profile.avatar.regenerate`. The previous seed is overwritten and never stored, making regeneration irreversible. Document the feature in `AGENTS.md` and `README.md`, add the API endpoint to `docs_api.py`, and include the `regenerate_avatar` Devii tool in `CONFIRM_REQUIRED`.

tests/e2e/game/index.py

@@ -155,6 +155,30 @@ def test_upgrade_perk(alice):
     ).to_have_text("Lv 1/10")
 
 
+def _set_farm_stars(username, stars):
+    from devplacepy.database import get_table
+    from devplacepy.services.game import store
+
+    user = get_table("users").find_one(username=username)
+    farm = store.get_farm(user["uid"])
+    get_table("game_farms").update({"uid": farm["uid"], "stars": stars}, ["uid"])
+
+
+def test_upgrade_legacy_spends_stars(alice):
+    page, _ = alice
+    reset_farm("alice_test")
+    _set_farm_stars("alice_test", 1000)
+    open_game(page)
+    buy = page.locator(
+        "form[data-game-action='legacy']:has(input[value='multiplier']) button"
+    )
+    buy.wait_for(state="visible")
+    buy.click()
+    expect(
+        page.locator(".legacy-card:has-text('Tech Debt Payoff') .perk-level")
+    ).to_have_text("Lv 1/10")
+
+
 def test_claim_quest(alice):
     page, _ = alice
     from devplacepy.database import get_table

tests/e2e/profile/regenerateavatar.py

@@ -0,0 +1,30 @@
+# retoor <retoor@molodetz.nl>
+
+from playwright.sync_api import expect
+from tests.conftest import BASE_URL
+
+
+def test_regenerate_avatar_updates_preview(alice):
+    page, user = alice
+    page.goto(
+        f"{BASE_URL}/profile/{user['username']}", wait_until="domcontentloaded"
+    )
+    preview = page.locator("#profile-avatar-preview")
+    expect(preview).to_be_visible()
+    before = preview.get_attribute("src")
+
+    page.locator("[data-regenerate-avatar]").click()
+    page.locator(".dialog-overlay.visible .dialog-confirm").click()
+
+    expect(preview).not_to_have_attribute("src", before)
+    after = preview.get_attribute("src")
+    assert after.startswith("/avatar/multiavatar/")
+
+
+def test_regenerate_button_hidden_for_other_user(alice, bob):
+    page, _ = alice
+    bob_page, bob_user = bob
+    page.goto(
+        f"{BASE_URL}/profile/{bob_user['username']}", wait_until="domcontentloaded"
+    )
+    expect(page.locator("[data-regenerate-avatar]")).to_have_count(0)