feat: restrict backup archive download to primary admin and hide admin-hidden projects from other admins

- Add `get_admin_uids()` and `get_primary_admin_uid()` to database.py for resolving the earliest-created admin
- Modify `can_view_project()` in content.py so a project hidden by an admin is invisible to other admins (both web UI and REST API)
- Update `_download_url()` and `_backup_payload()` in admin/backups.py to accept a `can_download` flag, gating the download endpoint with `is_primary_admin()`
- Remove `role` from `_user_facts()` in docs_live.py to avoid leaking admin status in live docs
- Update doc summaries in docs_api.py to reflect the new admin-visibility and backup-download semantics

tests/unit/services/dbapi/crud.py

@@ -5,86 +5,56 @@ import pytest
 from devplacepy.database import get_table, purge
 from devplacepy.services.dbapi import crud
 from devplacepy.services.dbapi.crud import DbApiError
+from devplacepy.utils import generate_uid
 
-ACTOR = "unit_dbapi_actor"
 MARK = "_unit_dbapi_crud"
 
 
 @pytest.fixture
-def clean_bookmarks(local_db):
-    yield
+def seeded_bookmark(local_db):
+    uid = generate_uid()
+    get_table("bookmarks").insert(
+        {
+            "uid": uid,
+            "user_uid": MARK,
+            "target_type": "post",
+            "target_uid": "t1",
+            "deleted_at": None,
+            "deleted_by": None,
+        }
+    )
+    yield uid
     purge("bookmarks", user_uid=MARK)
 
 
-def _insert():
-    return crud.insert_row(
-        "bookmarks",
-        {"user_uid": MARK, "target_type": "post", "target_uid": "t1"},
-        ACTOR,
-    )
+def test_get_row(seeded_bookmark):
+    row = crud.get_row("bookmarks", "uid", seeded_bookmark)
+    assert row["uid"] == seeded_bookmark
+    assert row["user_uid"] == MARK
 
 
-def test_insert_is_born_live(clean_bookmarks):
-    row = _insert()
-    assert row["uid"]
-    assert row["deleted_at"] is None
-    assert row["deleted_by"] is None
-    assert row.get("created_at")
+def test_list_rows_filters(seeded_bookmark):
+    rows, _ = crud.list_rows("bookmarks", filters={"user_uid": MARK})
+    assert len(rows) == 1
+    assert rows[0]["uid"] == seeded_bookmark
 
 
-def test_insert_rejects_unknown_columns(clean_bookmarks):
-    with pytest.raises(DbApiError):
-        crud.insert_row("bookmarks", {"user_uid": MARK, "no_such_col": 1}, ACTOR)
-
-
-def test_get_and_update_row(clean_bookmarks):
-    row = _insert()
-    fetched = crud.get_row("bookmarks", "uid", row["uid"])
-    assert fetched["uid"] == row["uid"]
-    updated = crud.update_row(
-        "bookmarks", "uid", row["uid"], {"target_uid": "t2"}, ACTOR
-    )
-    assert updated["target_uid"] == "t2"
-
-
-def test_update_cannot_change_uid(clean_bookmarks):
-    row = _insert()
-    crud.update_row("bookmarks", "uid", row["uid"], {"uid": "hacked"}, ACTOR)
-    assert get_table("bookmarks").find_one(uid="hacked") is None
-
-
-def test_soft_delete_then_restore(clean_bookmarks):
-    row = _insert()
-    outcome = crud.delete_row("bookmarks", "uid", row["uid"], ACTOR)
-    assert outcome["mode"] == "soft"
-    live, _ = crud.list_rows("bookmarks", filters={"user_uid": MARK})
-    assert live == []
-    deleted, _ = crud.list_rows(
-        "bookmarks", filters={"user_uid": MARK}, include_deleted=True
-    )
-    assert len(deleted) == 1
-    restored = crud.restore_row("bookmarks", "uid", row["uid"], ACTOR)
-    assert restored["deleted_at"] is None
-
-
-def test_hard_delete_purges(clean_bookmarks):
-    row = _insert()
-    outcome = crud.delete_row("bookmarks", "uid", row["uid"], ACTOR, hard=True)
-    assert outcome["mode"] == "hard"
-    assert get_table("bookmarks").find_one(uid=row["uid"]) is None
-
-
-def test_list_rows_caps_limit(clean_bookmarks):
+def test_list_rows_caps_limit(seeded_bookmark):
     rows, _ = crud.list_rows("bookmarks", limit=99999)
     assert isinstance(rows, list)
 
 
-def test_schema_reports_soft_delete(local_db):
+def test_schema_reports_soft_delete(seeded_bookmark):
     schema = crud.schema("bookmarks")
     assert schema["soft_delete"] is True
     assert any(c["name"] == "uid" for c in schema["columns"])
 
 
-def test_bad_key_raises(local_db):
+def test_bad_key_raises(seeded_bookmark):
     with pytest.raises(DbApiError):
         crud.get_row("bookmarks", "no_such_key", "x")
+
+
+def test_no_write_functions_exist():
+    for name in ("insert_row", "update_row", "delete_row", "restore_row"):
+        assert not hasattr(crud, name)

tests/unit/services/devii/actions/catalog.py

@@ -29,12 +29,10 @@ def test_db_get_tools_are_read_only():
         assert _records_mutation(name) is False
 
 
-def test_db_mutation_tools_record_and_confirm():
-    for name in ("db_insert_row", "db_update_row", "db_delete_row"):
-        action = BY_NAME[name]
-        assert action.is_read_only is False
-        assert _records_mutation(name) is True
-        assert name in CONFIRM_REQUIRED
+def test_db_has_no_mutation_tools():
+    for name in ("db_insert_row", "db_update_row", "db_delete_row", "db_restore_row"):
+        assert name not in BY_NAME
+        assert name not in CONFIRM_REQUIRED
 
 
 def test_seo_report_is_public_read_only_http_action():