Resolve the primary administrator to an account that can authenticate

The primary administrator was the earliest Admin by created_at with no further
condition, so a soft-deleted or deactivated account could hold the role and then
be refused by the api-key path, leaving nobody able to use the database API, the
backup download or cross-owner container management. Rows with no recorded signup
time also sorted ahead of every real account. Scan the earliest admins instead and
take the first that is neither deleted nor deactivated, with missing timestamps
sorted last.

Also stop the projects listing returning 500 when project_type or description is
NULL (the dict default never applies to an existing NULL column), align the issue
test fixture with its unit twin so a combined run cannot collide on a fixed uid,
read the settings value from the database rather than a stale per-process cache,
and give the seeded and fixture admins the is_active and created_at fields that
every real signup writes.

tests/conftest.py

@@ -14,6 +14,10 @@ SCREENSHOT_DIR = Path("/tmp/devplace_test_screenshots")
 
 PORT = int(os.environ.get("DEVPLACE_TEST_PORT", "10501"))
 BASE_URL = f"http://127.0.0.1:{PORT}"
+# Older than any user a fixture can create, so the seeded admin stays primary administrator.
+PRIMARY_ADMIN_CREATED_AT = "2000-01-01T00:00:00"
+# The cross-worker cache-version read is 1s; give the server a beat to see the new admin set.
+CACHE_VERSION_PROPAGATION_SECONDS = 1.5
 
 _TEST_DB = tempfile.NamedTemporaryFile(suffix=f"_{PORT}.db", delete=False)
 _TEST_DB.close()
@@ -317,6 +321,22 @@ def seeded_db(app_server):
         row = users_table.find_one(username=username)
         if row and row.get("role") != role:
             users_table.update({"uid": row["uid"], "role": role}, ["uid"])
+
+    # The primary administrator is the earliest-created Admin, and unit-tier fixtures
+    # create their own admins in this same database before the api tier seeds alice.
+    # Back-date her so she is unambiguously the platform's first administrator, which
+    # is what every primary-admin test (dbapi, backup download, container isolation)
+    # assumes. Without this, a combined unit+api run hands primary admin to a fixture
+    # user and those tests 403.
+    from devplacepy.database import invalidate_admins_cache as _invalidate_admins
+
+    alice_row = users_table.find_one(username="alice_test")
+    if alice_row:
+        users_table.update(
+            {"uid": alice_row["uid"], "created_at": PRIMARY_ADMIN_CREATED_AT}, ["uid"]
+        )
+        _invalidate_admins()
+        time.sleep(CACHE_VERSION_PROPAGATION_SECONDS)
     return {
         "alice": {
             "username": "alice_test",