Fix circular import, primary-admin NULL trap, and add gateway quota reset

Restores a working import graph and closes two data-correctness bugs, plus
adds a reset for the AI gateway's rolling 24h spend.

Circular import: database/__init__ -> engagement -> content -> utils ->
database made the package unimportable. get_project_devlog moves out of
database/engagement.py into content.py, where enrich_items already lives.

Primary administrator: _can_hold_primary_admin read is_active with
bool(row.get("is_active")), so an admin row whose is_active column is SQL
NULL (any row predating the column) was treated as deactivated and skipped.
Every other site defaults an unknown is_active to active; this one now does
too.

Profile JSON: xp_next_level and xp_progress_pct were computed but only put on
the top-level context, never on profile_user, so they serialised as null even
though UserOut declares them and the API docs document them as embedded there.

Gateway quota reset: a cap previously lifted only with the passage of time.
quota.reset upserts a watermark row into gateway_quota_resets, scoped by the
same three nullable dimensions as a quota rule, and spent_24h sums from
max(24h cutoff, watermark). No ledger row is deleted, so the cost analytics on
/admin/ai-usage stay intact. Reaches every surface: POST
/admin/gateway/quota-resets, a per-rule Reset spend button, the Devii tool
gateway_quota_reset (confirm-gated), devplace gateway quota reset, and the API
docs. Admin's Reset all quotas now stamps a global gateway watermark too,
which is what a caller stuck on "AI gateway daily quota exceeded" needed.

Startup: _backfill_gamification swept every xp=0 user on every boot in every
worker and could never converge, since a user with no content earns no XP.
It now intersects pending users with _milestone_candidates(). db.tables is a
live reflection, so it is hoisted out of the loops that probed it per row.

Docker: the dependency layer now depends on pyproject.toml only, so a source
edit no longer reinstalls every dependency and re-downloads Chromium.
Adds start_interval so the healthcheck probes during the start period, and a
docker-reload target, since docker-up does not restart an unchanged container.

Adds events.md, the audit event catalogue that README, CLAUDE.md, the quiz
docs and the tooling all referenced but which never existed: 288 keys across
28 categories, including the families built from a variable at the call site.

Test fixes: both devlog helpers dated post 0 as the newest while the tests
assumed post 2 was; a profile login posted username= to a form that takes
email=; a devlog assertion matched six buttons under strict mode; and the
primary-admin tests seeded founders newer than the back-dated fixture admin,
so they only passed without the api tier.

Full suite: 2989 passed, 1 skipped.

README.md

@@ -543,6 +543,17 @@ disclosed only to administrators, while members and guests can see only the perc
 24-hour quota used. The `/devii/usage` endpoint returns that percentage and the day's turn count to
 everyone, and includes dollar figures only for administrators.
 
+**Spend limits (Gateway page, `/admin/gateway`).** An administrator caps the rolling 24-hour
+gateway spend with quota rules scoped by any combination of caller role, individual user, and
+application reference (the `X-App-Reference` header), so a single application belonging to one
+user can be limited independently of that user's other traffic. The most specific matching rule
+wins; a caller over its cap gets `429`. Because a cap otherwise only lifts with the passage of
+time, each rule has a **Reset spend** action that clears what has been counted against it
+without deleting anything from the usage history the cost analytics are built on - the
+figures on the AI usage page stay intact, only the amount counted towards the limit is cleared.
+The **Reset all quotas** button on the AI usage page clears the assistant quotas and the gateway
+spend together. From the terminal: `devplace gateway quota list|set|delete|reset`.
+
 Configuration on the Services tab:
 
 | Parameter | Default | Purpose |
@@ -984,11 +995,13 @@ Open `http://<host>:${PORT}` (default 10500). `make docker-logs` tails output; `
 
 ```bash
 git pull
-make docker-up              # restart with new code (bind-mounted, no rebuild)
+make docker-reload          # restart workers on the new code (bind-mounted, no rebuild)
 make docker-build && \
   make docker-up            # only when dependencies in pyproject.toml change
 ```
 
+`make docker-reload` is the target for a source-only change: `docker compose up -d` leaves an unchanged container running, so the workers would keep serving the code they imported at boot. A rebuild after a source-only change costs about 7 seconds because the Dockerfile installs dependencies from `pyproject.toml` in a layer that no source edit invalidates.
+
 The `make deploy` target fast-forwards the `production` branch (`git checkout production && git merge master && git push origin production`); pull that branch on the server.
 
 ### Container Manager wiring (what the overlay does)