feat: restrict backup archive download to primary admin and hide admin-hidden projects from other admins

- Add `get_admin_uids()` and `get_primary_admin_uid()` to database.py for resolving the earliest-created admin
- Modify `can_view_project()` in content.py so a project hidden by an admin is invisible to other admins (both web UI and REST API)
- Update `_download_url()` and `_backup_payload()` in admin/backups.py to accept a `can_download` flag, gating the download endpoint with `is_primary_admin()`
- Remove `role` from `_user_facts()` in docs_live.py to avoid leaking admin status in live docs
- Update doc summaries in docs_api.py to reflect the new admin-visibility and backup-download semantics

tests/unit/content.py

@@ -3,6 +3,7 @@
 from datetime import datetime, timezone
 from devplacepy.content import (
     is_owner,
+    can_view_project,
     canonical_redirect,
     first_image_url,
     enrich_items,
@@ -96,6 +97,54 @@ def test_is_owner_matches_user_uid():
     assert is_owner({"user_uid": "u1"}, None) is False
 
 
+def _make_user(role="Member"):
+    uid = generate_uid()
+    username = f"cv_{uid[:8]}"
+    get_table("users").insert(
+        {
+            "uid": uid,
+            "username": username,
+            "email": f"{username}@t.dev",
+            "role": role,
+            "created_at": datetime.now(timezone.utc).isoformat(),
+        }
+    )
+    return get_table("users").find_one(uid=uid)
+
+
+def test_can_view_project_public_visible_to_everyone(local_db):
+    owner = _make_user()
+    other = _make_user()
+    admin = _make_user("Admin")
+    project = {"user_uid": owner["uid"], "is_private": 0}
+    assert can_view_project(project, owner) is True
+    assert can_view_project(project, other) is True
+    assert can_view_project(project, admin) is True
+    assert can_view_project(project, None) is True
+
+
+def test_can_view_member_private_visible_to_owner_and_admin(local_db):
+    owner = _make_user()
+    other = _make_user()
+    admin = _make_user("Admin")
+    project = {"user_uid": owner["uid"], "is_private": 1}
+    assert can_view_project(project, owner) is True
+    assert can_view_project(project, admin) is True
+    assert can_view_project(project, other) is False
+    assert can_view_project(project, None) is False
+
+
+def test_can_view_admin_private_visible_to_owner_admin_only(local_db):
+    owner_admin = _make_user("Admin")
+    other_admin = _make_user("Admin")
+    member = _make_user()
+    project = {"user_uid": owner_admin["uid"], "is_private": 1}
+    assert can_view_project(project, owner_admin) is True
+    assert can_view_project(project, other_admin) is False
+    assert can_view_project(project, member) is False
+    assert can_view_project(project, None) is False
+
+
 def test_canonical_redirect_when_slug_differs():
     item = {"slug": "abcd1234-title", "uid": "abcd1234"}
     assert canonical_redirect("posts", item, "abcd1234-title") is None