feat: restrict backup archive download to primary admin and hide admin-hidden projects from other admins

- Add `get_admin_uids()` and `get_primary_admin_uid()` to database.py for resolving the earliest-created admin
- Modify `can_view_project()` in content.py so a project hidden by an admin is invisible to other admins (both web UI and REST API)
- Update `_download_url()` and `_backup_payload()` in admin/backups.py to accept a `can_download` flag, gating the download endpoint with `is_primary_admin()`
- Remove `role` from `_user_facts()` in docs_live.py to avoid leaking admin status in live docs
- Update doc summaries in docs_api.py to reflect the new admin-visibility and backup-download semantics

devplacepy/routers/admin/users.py

@@ -29,6 +29,33 @@ logger = logging.getLogger(__name__)
 router = APIRouter()
 
 
+def _seniority_key(u: dict) -> tuple[str, int]:
+    return (u.get("created_at") or "", u.get("id") or 0)
+
+
+def _is_senior_admin(actor: dict, target: dict | None) -> bool:
+    if not target or target.get("role") != "Admin":
+        return False
+    if target.get("uid") == actor.get("uid"):
+        return False
+    return _seniority_key(target) < _seniority_key(actor)
+
+
+def _deny_senior(request: Request, admin: dict, uid: str, target: dict, event_key: str):
+    audit.record(
+        request,
+        event_key,
+        user=admin,
+        result="denied",
+        target_type="user",
+        target_uid=uid,
+        target_label=target.get("username"),
+        summary=f"admin {admin['username']} cannot manage senior admin {target.get('username')}",
+        links=[audit.target("user", uid, target.get("username"))],
+    )
+    return action_result(request, "/admin/users")
+
+
 @router.get("/users/{uid}/ai-usage")
 async def admin_user_ai_usage(request: Request, uid: str, hours: int = 24):
     user = get_current_user(request)
@@ -105,6 +132,8 @@ async def admin_user_role(
         return action_result(request, "/admin/users")
     users = get_table("users")
     target_user = users.find_one(uid=uid)
+    if _is_senior_admin(admin, target_user):
+        return _deny_senior(request, admin, uid, target_user, "admin.user.role.change")
     old_role = target_user.get("role") if target_user else None
     users.update({"uid": uid, "role": role}, ["uid"])
     clear_user_cache(uid)
@@ -135,6 +164,8 @@ async def admin_user_password(
     admin = require_admin(request)
     users = get_table("users")
     target_user = users.find_one(uid=uid)
+    if _is_senior_admin(admin, target_user):
+        return _deny_senior(request, admin, uid, target_user, "admin.user.password.reset")
     users.update({"uid": uid, "password_hash": await hash_password_async(data.password)}, ["uid"])
     logger.info(f"Admin {admin['username']} changed password for user {uid}")
     audit.record(
@@ -172,6 +203,8 @@ async def admin_user_toggle(request: Request, uid: str):
         return action_result(request, "/admin/users")
     users = get_table("users")
     user = users.find_one(uid=uid)
+    if _is_senior_admin(admin, user):
+        return _deny_senior(request, admin, uid, user, "admin.user.active.disable")
     if user:
         new_state = not user.get("is_active", True)
         users.update({"uid": uid, "is_active": new_state}, ["uid"])
@@ -196,12 +229,14 @@ async def admin_user_toggle(request: Request, uid: str):
 @router.post("/users/{uid}/reset-ai-quota")
 async def admin_user_reset_ai_quota(request: Request, uid: str):
     admin = require_admin(request)
+    target_user = get_table("users").find_one(uid=uid)
+    if _is_senior_admin(admin, target_user):
+        return _deny_senior(request, admin, uid, target_user, "admin.user.ai_quota.reset")
     devii = service_manager.get_service("devii")
     removed = devii.reset_quota("user", uid) if devii is not None else 0
     logger.info(
         f"Admin {admin['username']} reset AI quota for user {uid} ({removed} ledger rows)"
     )
-    target_user = get_table("users").find_one(uid=uid)
     audit.record(
         request,
         "admin.user.ai_quota.reset",