Add personal notes, DeepSearch history, backup offload, and gateway auth throttling

Also streamline the top navigation: drop the Tools dropdown, make Quizzes
and Battles icon-only entries, and remove the Workspace, Containers and
Editor entry points from the project detail page.

tests/api/notes/saved.py

@@ -0,0 +1,89 @@
+# retoor <retoor@molodetz.nl>
+
+import time
+from datetime import datetime, timezone
+import requests
+from tests.conftest import BASE_URL
+from devplacepy.database import get_table
+from devplacepy.utils import generate_uid
+
+_counter_notes = [0]
+AJAX_notes = {"X-Requested-With": "fetch"}
+
+
+def _session_notes():
+    _counter_notes[0] += 1
+    name = f"ntesv{int(time.time() * 1000)}{_counter_notes[0]}"
+    s = requests.Session()
+    s.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
+        },
+        allow_redirects=True,
+    )
+    return s, name
+
+
+def _uid_notes(username):
+    return get_table("users").find_one(username=username)["uid"]
+
+
+def _make_post_notes(owner_uid, title):
+    uid = generate_uid()
+    get_table("posts").insert(
+        {
+            "deleted_at": None,
+            "deleted_by": None,
+            "uid": uid,
+            "user_uid": owner_uid,
+            "slug": f"{uid[:8]}-note-saved-post",
+            "title": title,
+            "content": "note saved target content",
+            "topic": "random",
+            "project_uid": None,
+            "image": None,
+            "stars": 0,
+            "created_at": datetime.now(timezone.utc).isoformat(),
+        }
+    )
+    return uid
+
+
+def test_notes_saved_page_lists_note_content(app_server):
+    s, name = _session_notes()
+    owner_uid = _uid_notes(name)
+    post_title = f"Note saved post {int(time.time() * 1000)}"
+    post_uid = _make_post_notes(owner_uid, post_title)
+    s.post(
+        f"{BASE_URL}/notes/post/{post_uid}",
+        headers=AJAX_notes,
+        data={"content": "A note worth remembering."},
+    )
+    html = s.get(f"{BASE_URL}/notes/saved").text
+    assert post_title in html
+    assert "A note worth remembering." in html
+
+
+def test_notes_saved_page_requires_login(app_server):
+    anon = requests.Session()
+    r = anon.get(f"{BASE_URL}/notes/saved", allow_redirects=False)
+    assert r.status_code == 303
+
+
+def test_notes_saved_page_only_shows_own_notes(app_server):
+    alice, alice_name = _session_notes()
+    bob, bob_name = _session_notes()
+    post_uid = _make_post_notes(_uid_notes(alice_name), "Isolation saved post")
+    alice.post(
+        f"{BASE_URL}/notes/post/{post_uid}",
+        headers=AJAX_notes,
+        data={"content": "Alice only note."},
+    )
+    html = bob.get(f"{BASE_URL}/notes/saved").text
+    assert "Alice only note." not in html