Attribute Devii AI spend to its invoking action, fix quiz question-at-a-time review, DB API/isslop result routes, workspace docs, and drop redundant docstrings

- Route Devii-driven AI gateway cost to the action/tool that triggered
  it instead of a blanket "internal" bucket, so per-feature AI spend
  is attributable.
- Fix the quiz attempt review to show one previously-answered question
  at a time instead of all of them at once, and stop a quiz endpoint
  linked from the quiz flow from responding with raw JSON.
- Add DB API async query result route and AI Usage Analyzer annotated
  source/media routes, with traversal-safe uid/path handling and
  matching tests.
- Add Code Farm action audit logging (plant/harvest/buy-plot/upgrade/
  fertilize) and related admin workspace/services/trash/gateway route
  and doc touch-ups.
- Drop redundant docstrings from access_tokens.py per the no-comments
  convention.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VL9Xn57W5UR3HZbbuuzxdK

tests/unit/test_devrant_token_auth.py

@@ -68,7 +68,7 @@ def _seed_token(user_uid, key, expire_time):
 # ── resolve_user_by_key tests ────────────────────────────────────────────────
 
 def test_resolve_user_by_key_valid(local_db):
-    """Create a devrant token for a user, then resolve it by key — the right user is returned."""
+    """Create a devrant token for a user, then resolve it by key - the right user is returned."""
     uid = _seed_user("dr_valid", "drvalid@test.dev")
     token_key = secrets.token_hex(20)
     expire_time = int(datetime.now(timezone.utc).timestamp()) + 86400
@@ -81,13 +81,13 @@ def test_resolve_user_by_key_valid(local_db):
 
 
 def test_resolve_user_by_key_not_found(local_db):
-    """Look up a random key that has no token — verify None."""
+    """Look up a random key that has no token - verify None."""
     random_key = secrets.token_hex(20)
     assert resolve_user_by_key(random_key) is None
 
 
 def test_resolve_user_by_key_expired(local_db):
-    """Create an expired token — resolve returns None."""
+    """Create an expired token - resolve returns None."""
     uid = _seed_user("dr_expired", "drexpired@test.dev")
     token_key = secrets.token_hex(20)
     expire_time = int(datetime.now(timezone.utc).timestamp()) - 86400
@@ -97,7 +97,7 @@ def test_resolve_user_by_key_expired(local_db):
 
 
 def test_resolve_user_by_key_inactive_user(local_db):
-    """Create a token for an inactive user — resolve returns None."""
+    """Create a token for an inactive user - resolve returns None."""
     uid = _seed_user("dr_inactive", "drinactive@test.dev", is_active=False)
     token_key = secrets.token_hex(20)
     expire_time = int(datetime.now(timezone.utc).timestamp()) + 86400
@@ -162,10 +162,10 @@ def test_resolve_user_prefers_api_key_over_devrant(local_db):
     """If a key matches both an api_key and a devrant token, the api_key user wins."""
     shared_key = secrets.token_hex(20)
 
-    # User A — owns the api_key
+    # User A - owns the api_key
     uid_a = _seed_user("api_key_owner", "apikey@test.dev", api_key=shared_key)
 
-    # User B — owns the devrant token with the same key
+    # User B - owns the devrant token with the same key
     uid_b = _seed_user("devrant_owner", "drowner@test.dev")
     expire_time = int(datetime.now(timezone.utc).timestamp()) + 86400
     _seed_token(uid_b, shared_key, expire_time)