Resolve the primary administrator to an account that can authenticate

The primary administrator was the earliest Admin by created_at with no further
condition, so a soft-deleted or deactivated account could hold the role and then
be refused by the api-key path, leaving nobody able to use the database API, the
backup download or cross-owner container management. Rows with no recorded signup
time also sorted ahead of every real account. Scan the earliest admins instead and
take the first that is neither deleted nor deactivated, with missing timestamps
sorted last.

Also stop the projects listing returning 500 when project_type or description is
NULL (the dict default never applies to an existing NULL column), align the issue
test fixture with its unit twin so a combined run cannot collide on a fixed uid,
read the settings value from the database rather than a stale per-process cache,
and give the seeded and fixture admins the is_active and created_at fields that
every real signup writes.

tests/api/admin/services/config.py

@@ -4,7 +4,13 @@ import time
 import pytest
 import requests
 from tests.conftest import BASE_URL
-from devplacepy.database import get_table, refresh_snapshot, set_setting, get_setting
+from devplacepy.database import (
+    clear_settings_cache,
+    get_setting,
+    get_table,
+    refresh_snapshot,
+    set_setting,
+)
 
 JSON = {"Accept": "application/json"}
 _counter_cfg = [0]
@@ -58,6 +64,9 @@ def test_admin_saves_service_config(seeded_db):
         assert r.status_code == 200, r.text[:300]
         assert r.json().get("ok") is True
         refresh_snapshot()
+        # the server persisted it in its own process; drop this process's 60s settings
+        # cache so the assertion reads the database rather than a pre-save snapshot
+        clear_settings_cache()
         assert get_setting("news_ai_model", "") == new_model
     finally:
         if original:

tests/api/issues/create.py

@@ -157,7 +157,9 @@ def _make_user_issues_gitea():
     _counter_issues_gitea[0] += 1
     uid = f"issuetest-user-{_counter_issues_gitea[0]}"
     username = f"issuetester{_counter_issues_gitea[0]}"
-    get_table("users").insert(
+    # upsert, not insert: tests/unit/services/gitea.py is a twin fixture sharing this
+    # uid namespace with its own counter, so a combined unit+api run collides on the uid
+    get_table("users").upsert(
         {
             "uid": uid,
             "username": username,
@@ -165,7 +167,8 @@ def _make_user_issues_gitea():
             "xp": 0,
             "level": 1,
             "is_active": True,
-        }
+        },
+        ["uid"],
     )
     return uid, username
 def _unread(user_uid):