Attribute Devii AI spend to its invoking action, fix quiz question-at-a-time review, DB API/isslop result routes, workspace docs, and drop redundant docstrings

- Route Devii-driven AI gateway cost to the action/tool that triggered
  it instead of a blanket "internal" bucket, so per-feature AI spend
  is attributable.
- Fix the quiz attempt review to show one previously-answered question
  at a time instead of all of them at once, and stop a quiz endpoint
  linked from the quiz flow from responding with raw JSON.
- Add DB API async query result route and AI Usage Analyzer annotated
  source/media routes, with traversal-safe uid/path handling and
  matching tests.
- Add Code Farm action audit logging (plant/harvest/buy-plot/upgrade/
  fertilize) and related admin workspace/services/trash/gateway route
  and doc touch-ups.
- Drop redundant docstrings from access_tokens.py per the no-comments
  convention.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VL9Xn57W5UR3HZbbuuzxdK

tests/unit/test_access_tokens.py

@@ -81,7 +81,7 @@ def test_issue_token_returns_expected_fields(local_db):
 
 
 def test_resolve_token_valid(local_db):
-    """Issue a token then resolve it — returns the correct user."""
+    """Issue a token then resolve it - returns the correct user."""
     uid = _seed_user("resolver", "resolver@test.dev")
     user = get_table("users").find_one(uid=uid)
 
@@ -239,10 +239,10 @@ def test_resolve_user_access_token_priority_after_api_key(local_db):
     """api_key user wins over access token when the same string matches both."""
     shared_key = secrets.token_hex(32)  # 64-char hex
 
-    # User A — owns the api_key
+    # User A - owns the api_key
     uid_a = _seed_user("apikey_winner", "apikeywinner@test.dev", api_key=shared_key)
 
-    # User B — owns an access token with the same string as the key
+    # User B - owns an access token with the same string as the key
     uid_b = _seed_user("acctok_loser", "acctokloser@test.dev")
     get_table("access_tokens").insert(
         {
@@ -257,14 +257,14 @@ def test_resolve_user_access_token_priority_after_api_key(local_db):
         }
     )
 
-    # X-API-KEY path — api_key user wins
+    # X-API-KEY path - api_key user wins
     request = _MockRequest(headers={"X-API-KEY": shared_key})
     resolved = _resolve_user(request)
     assert resolved is not None
     assert resolved["uid"] == uid_a
     assert resolved["username"] == "apikey_winner"
 
-    # Bearer path — api_key user wins
+    # Bearer path - api_key user wins
     request2 = _MockRequest(headers={"Authorization": f"Bearer {shared_key}"})
     resolved2 = _resolve_user(request2)
     assert resolved2 is not None