Attribute Devii AI spend to its invoking action, fix quiz question-at-a-time review, DB API/isslop result routes, workspace docs, and drop redundant docstrings

- Route Devii-driven AI gateway cost to the action/tool that triggered
  it instead of a blanket "internal" bucket, so per-feature AI spend
  is attributable.
- Fix the quiz attempt review to show one previously-answered question
  at a time instead of all of them at once, and stop a quiz endpoint
  linked from the quiz flow from responding with raw JSON.
- Add DB API async query result route and AI Usage Analyzer annotated
  source/media routes, with traversal-safe uid/path handling and
  matching tests.
- Add Code Farm action audit logging (plant/harvest/buy-plot/upgrade/
  fertilize) and related admin workspace/services/trash/gateway route
  and doc touch-ups.
- Drop redundant docstrings from access_tokens.py per the no-comments
  convention.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VL9Xn57W5UR3HZbbuuzxdK

tests/api/projects/workspace.py

@@ -61,8 +61,10 @@ def _instance(**overrides) -> dict:
 
 def test_open_workspace_requires_enabled_setting():
     set_setting("workspace_enabled", "0")
-    assert can_open_workspace(_project(), {"uid": OWNER, "role": "Member"}) is False
-    set_setting("workspace_enabled", "1")
+    try:
+        assert can_open_workspace(_project(), {"uid": OWNER, "role": "Member"}) is False
+    finally:
+        set_setting("workspace_enabled", "1")
     assert can_open_workspace(_project(), {"uid": OWNER, "role": "Member"}) is True
 
 
@@ -98,11 +100,13 @@ def test_create_or_resume_is_idempotent():
 
 def test_workspace_quota_blocks_beyond_limit():
     set_setting("workspace_max_per_user", "1")
-    user = {"uid": OWNER, "username": "owner"}
-    run_async(provision.ensure(_project("p-a"), user))
-    with pytest.raises(WorkspaceError):
-        run_async(provision.ensure(_project("p-b"), user))
-    set_setting("workspace_max_per_user", "2")
+    try:
+        user = {"uid": OWNER, "username": "owner"}
+        run_async(provision.ensure(_project("p-a"), user))
+        with pytest.raises(WorkspaceError):
+            run_async(provision.ensure(_project("p-b"), user))
+    finally:
+        set_setting("workspace_max_per_user", "2")
 
 
 def test_tunnel_revives_rather_than_duplicates():