Attribute Devii AI spend to its invoking action, fix quiz question-at-a-time review, DB API/isslop result routes, workspace docs, and drop redundant docstrings

- Route Devii-driven AI gateway cost to the action/tool that triggered
  it instead of a blanket "internal" bucket, so per-feature AI spend
  is attributable.
- Fix the quiz attempt review to show one previously-answered question
  at a time instead of all of them at once, and stop a quiz endpoint
  linked from the quiz flow from responding with raw JSON.
- Add DB API async query result route and AI Usage Analyzer annotated
  source/media routes, with traversal-safe uid/path handling and
  matching tests.
- Add Code Farm action audit logging (plant/harvest/buy-plot/upgrade/
  fertilize) and related admin workspace/services/trash/gateway route
  and doc touch-ups.
- Drop redundant docstrings from access_tokens.py per the no-comments
  convention.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VL9Xn57W5UR3HZbbuuzxdK

tests/api/tools/isslop.py

@@ -1,11 +1,14 @@
 # retoor <retoor@molodetz.nl>
 
 import time
+import uuid
 
 import requests
 
 from tests.conftest import BASE_URL
 from devplacepy.database import get_table, refresh_snapshot
+from devplacepy.services.jobs.isslop import store
+from devplacepy.utils import generate_uid
 
 _counter_isslop = [0]
 
@@ -192,3 +195,103 @@ def test_guest_history_claimed_on_signup(app_server):
         assert get_table("isslop_analyses").count(uid=uid) == 1
     finally:
         _clear_isslop_data()
+
+
+def test_source_route_serves_the_annotated_file(app_server):
+    uid = generate_uid()
+    store.create_analysis(uid, "https://github.com/owner/repository", "guest", "src-owner")
+    source_name = "s" + uuid.uuid4().hex[:16] + ".txt"
+    store.insert_file_result(
+        uid,
+        {
+            "path": "app.py",
+            "language": "python",
+            "lines": 1,
+            "origin_score": 0.1,
+            "quality_deficit_score": 0.1,
+            "category": "human-authored",
+            "signals": "[]",
+            "source": source_name,
+        },
+    )
+    media_dir = store.media_dir_for(uid)
+    media_dir.mkdir(parents=True, exist_ok=True)
+    (media_dir / source_name).write_text("print('hello')\n", encoding="utf-8")
+    try:
+        r = requests.get(
+            f"{BASE_URL}/tools/isslop/{uid}/source",
+            params={"path": "app.py"},
+            headers=_json_headers(),
+        )
+        assert r.status_code == 200, r.text
+        body = r.json()
+        assert "print" in body["source"]
+        assert body["path"] == "app.py"
+    finally:
+        store.purge_analysis(uid)
+
+
+def test_source_route_rejects_an_unsafe_source_token(app_server):
+    uid = generate_uid()
+    store.create_analysis(uid, "https://github.com/owner/repository", "guest", "src-traversal-owner")
+    store.insert_file_result(
+        uid,
+        {
+            "path": "app.py",
+            "language": "python",
+            "lines": 1,
+            "origin_score": 0.0,
+            "quality_deficit_score": 0.0,
+            "category": "human-authored",
+            "signals": "[]",
+            "source": "../../../../etc/passwd",
+        },
+    )
+    try:
+        r = requests.get(
+            f"{BASE_URL}/tools/isslop/{uid}/source",
+            params={"path": "app.py"},
+            headers=_json_headers(),
+        )
+        assert r.status_code == 404
+    finally:
+        store.purge_analysis(uid)
+
+
+def test_media_route_serves_a_thumbnail(app_server):
+    uid = generate_uid()
+    store.create_analysis(uid, "https://github.com/owner/repository", "guest", "media-owner")
+    name = uuid.uuid4().hex[:16] + ".webp"
+    store.insert_image_result(
+        uid,
+        {
+            "path": "assets/hero.png",
+            "ai_probability": 0.2,
+            "grade": "n/a",
+            "verdict": "uncertain",
+            "image_kind": "image",
+            "tells": "[]",
+            "description": "",
+            "thumb": name,
+        },
+    )
+    media_dir = store.media_dir_for(uid)
+    media_dir.mkdir(parents=True, exist_ok=True)
+    (media_dir / name).write_bytes(b"not-a-real-webp-but-bytes")
+    try:
+        r = requests.get(f"{BASE_URL}/tools/isslop/{uid}/media/{name}")
+        assert r.status_code == 200, r.text
+        assert r.headers["content-type"].startswith("image/webp")
+        assert r.content == b"not-a-real-webp-but-bytes"
+    finally:
+        store.purge_analysis(uid)
+
+
+def test_media_route_rejects_a_name_outside_the_hex_pattern(app_server):
+    uid = generate_uid()
+    store.create_analysis(uid, "https://github.com/owner/repository", "guest", "media-traversal-owner")
+    try:
+        r = requests.get(f"{BASE_URL}/tools/isslop/{uid}/media/..%2fetc%2fpasswd")
+        assert r.status_code == 404, r.text
+    finally:
+        store.purge_analysis(uid)