chore: add agents/reports to gitignore and update agent infrastructure with timestamp streaming, write budget, and codename generation

- Add `agents/reports/` to `.gitignore` to prevent generated agent report files from being tracked
- Implement `_TimestampStream` class and `install_timestamps()` function in `agents/agent.py` for prefixing stdout/stderr with timestamps and elapsed time
- Export `install_timestamps`, `set_write_budget`, `clear_write_budget`, and `set_shell_restricted` from `agents/base.py`; add `_RUN_LOCK`, `AGENT_ICONS` dictionary, and `WRITE_BUDGET = 20` constant
- Add `report_codename()` function and `CODENAME_ADJECTIVES`/`CODENAME_ANIMALS` tuples to `agents/core/__init__.py` for generating random agent report codenames
- Expand `WRITE_TOOLS` tuple in `agents/core/__init__.py` to include `replace_lines`, `insert_lines`, and `delete_lines`; remove `SWARM_TOOLS` from `payloads_for` exclusion list
- Update `CLAUDE.md` and `AGENTS.md` documentation with dataset column initialization rules and new agent infrastructure details
- Reorder route table in `README.md` to list `/uploads` before `/messages` and document Swagger/ReDoc/OpenAPI schema endpoints

README.md

@@ -65,8 +65,9 @@ devplacepy/
 | `/p/{slug}` | Public ingress proxy (HTTP + WebSocket) to a running container instance's published port, opt-in per instance via `ingress_slug` |
 | `/profile` | Profile view, editing, and a public **Media** tab (`?tab=media`) showing every attachment a user uploaded, newest first |
 | `/media` | Per-attachment soft delete and restore: `POST /media/{uid}/delete` (owner or admin), `POST /media/{uid}/restore` (admin) |
-| `/messages` | Direct messaging |
+| `/uploads` | File upload endpoints: `POST /uploads/upload` (multipart), `POST /uploads/upload-url` (from URL); served at `/static/uploads/` |
 | `/notifications` | Notification list, mark read, live unread counts (`/notifications/counts`) |
+| `/messages` | Direct messaging |
 | `/votes` | Upvote/downvote on posts, comments, projects |
 | `/reactions` | Emoji reactions on posts, comments, gists, projects |
 | `/bookmarks` | Save/unsave content; `/bookmarks/saved` personal list |
@@ -203,7 +204,7 @@ pre-filled. Each panel has a response-format selector (defaulting to JSON) that
 **Expected** tab showing the modeled response, and a **Live response** tab for the real
 result. To document a new endpoint, add an entry to `docs_api.py`; the page, sidebar link,
 examples, runner, and expected-response sample are generated automatically. FastAPI's
-built-in Swagger is disabled so `/docs` belongs to this site.
+built-in Swagger is moved to `/swagger` so `/docs` belongs to this site. ReDoc is at `/redoc` and the raw schema at `/openapi.json`.
 
 Operator pages are admin-only: `/docs/admin.html` (user/news/settings administration) and
 `/docs/services.html` (Background Services) are hidden from the sidebar and return 404 for
@@ -501,8 +502,8 @@ calling itself.
 DevPlace ships a fleet of autonomous AI maintenance agents under `agents/` that
 keep the codebase consistent. Each agent owns one quality dimension, sweeps the
 whole repository for problems in that dimension, and either reports them or fixes
-them and verifies the build. The full design is in `agents.md`; the public,
-newbie-friendly guide is at `/docs/maintenance-agents.html` and
+them and verifies the build. The internals are documented in `AGENTS.md`; the
+public, newbie-friendly guide is at `/docs/maintenance-agents.html` and
 `/docs/maintenance-usage.html`.
 
 Every agent runs in two modes: `--fix` (default, autonomous) or `--check`
@@ -534,6 +535,16 @@ make agents-all              # run the whole fleet
 make agents-all CHECK=1      # CI gate across the fleet
 ```
 
+Every run is legible live: each agent prints a start banner (icon, name, a
+memorable codename, what it will do, and its report path), every line is prefixed
+with the wall-clock time and elapsed duration, each AI call streams its running
+dollar cost, and every file edit streams a unified diff. Reports land in
+`agents/reports/` as `<agent>-<codename>-<date>.{json,md}` (the orchestrator writes
+`fleet-<codename>-<date>.json`). Safety is enforced in code, not prompts: agents
+cannot edit anything under `agents/`, cannot shell out, and cannot modify more than
+a fixed number of files per run, and a run that exhausts its step budget is marked
+`incomplete` and exits non-zero rather than looking clean.
+
 ## Push notifications & PWA
 
 Authenticated users can receive native web push notifications, and the site is an
@@ -613,7 +624,7 @@ SQLite is synchronous by design and will never be made async. It is more than fa
 
 ## Testing
 
-- **419 tests** across 34 files: Playwright integration + in-process unit tests
+- **849+ tests** across 63 files: Playwright integration + in-process unit tests
 - Playwright (NOT pytest-playwright plugin - conflicts, uninstall it)
 - Runs in parallel via pytest-xdist (`make test` = `-n auto --dist loadfile`); each worker is an isolated uvicorn subprocess on port 10501+ with its own temp database and `DEVPLACE_DATA_DIR`
 - `loadfile` keeps every test in a file on one worker so session fixtures and ordering hold; cap workers with `make test TEST_WORKERS=4`