Fix circular import, primary-admin NULL trap, and add gateway quota reset

Restores a working import graph and closes two data-correctness bugs, plus
adds a reset for the AI gateway's rolling 24h spend.

Circular import: database/__init__ -> engagement -> content -> utils ->
database made the package unimportable. get_project_devlog moves out of
database/engagement.py into content.py, where enrich_items already lives.

Primary administrator: _can_hold_primary_admin read is_active with
bool(row.get("is_active")), so an admin row whose is_active column is SQL
NULL (any row predating the column) was treated as deactivated and skipped.
Every other site defaults an unknown is_active to active; this one now does
too.

Profile JSON: xp_next_level and xp_progress_pct were computed but only put on
the top-level context, never on profile_user, so they serialised as null even
though UserOut declares them and the API docs document them as embedded there.

Gateway quota reset: a cap previously lifted only with the passage of time.
quota.reset upserts a watermark row into gateway_quota_resets, scoped by the
same three nullable dimensions as a quota rule, and spent_24h sums from
max(24h cutoff, watermark). No ledger row is deleted, so the cost analytics on
/admin/ai-usage stay intact. Reaches every surface: POST
/admin/gateway/quota-resets, a per-rule Reset spend button, the Devii tool
gateway_quota_reset (confirm-gated), devplace gateway quota reset, and the API
docs. Admin's Reset all quotas now stamps a global gateway watermark too,
which is what a caller stuck on "AI gateway daily quota exceeded" needed.

Startup: _backfill_gamification swept every xp=0 user on every boot in every
worker and could never converge, since a user with no content earns no XP.
It now intersects pending users with _milestone_candidates(). db.tables is a
live reflection, so it is hoisted out of the loops that probed it per row.

Docker: the dependency layer now depends on pyproject.toml only, so a source
edit no longer reinstalls every dependency and re-downloads Chromium.
Adds start_interval so the healthcheck probes during the start period, and a
docker-reload target, since docker-up does not restart an unchanged container.

Adds events.md, the audit event catalogue that README, CLAUDE.md, the quiz
docs and the tooling all referenced but which never existed: 288 keys across
28 categories, including the families built from a variable at the call site.

Test fixes: both devlog helpers dated post 0 as the newest while the tests
assumed post 2 was; a profile login posted username= to a form that takes
email=; a devlog assertion matched six buttons under strict mode; and the
primary-admin tests seeded founders newer than the back-dated fixture admin,
so they only passed without the api tier.

Full suite: 2989 passed, 1 skipped.

devplacepy/routers/admin/aiquota.py

@@ -6,6 +6,7 @@ from devplacepy.utils import require_admin
 from devplacepy.responses import action_result
 from devplacepy.services.audit import record as audit
 from devplacepy.services.manager import service_manager
+from devplacepy.services.openai_gateway import quota
 
 logger = logging.getLogger(__name__)
 router = APIRouter()
@@ -34,14 +35,20 @@ async def admin_reset_all_ai_quota(request: Request):
     admin = require_admin(request)
     devii = service_manager.get_service("devii")
     removed = devii.reset_all_quotas() if devii is not None else 0
+    gateway = quota.reset(created_by=admin["uid"])
     logger.info(
-        f"Admin {admin['username']} reset ALL AI quotas ({removed} ledger rows)"
+        f"Admin {admin['username']} reset ALL AI quotas "
+        f"({removed} Devii ledger rows, gateway watermark {gateway['reset_at']})"
     )
     audit.record(
         request,
         "admin.ai_quota.reset_all",
         user=admin,
-        metadata={"rows_removed": removed},
-        summary=f"admin {admin['username']} reset all AI quotas",
+        metadata={"rows_removed": removed, "gateway_reset_at": gateway["reset_at"]},
+        summary=(
+            f"admin {admin['username']} reset all AI quotas "
+            "(Devii assistant and AI gateway)"
+        ),
     )
     return action_result(request, "/admin/ai-usage")
+

devplacepy/routers/admin/gateway_configs.py

@@ -197,14 +197,7 @@ def _quota_defaults_summary() -> dict:
 
 
 def _rule_label(rule: dict) -> str:
-    parts = []
-    if rule.get("owner_kind"):
-        parts.append(f"role={rule['owner_kind']}")
-    if rule.get("owner_id"):
-        parts.append(f"user={rule['owner_id']}")
-    if rule.get("app_reference"):
-        parts.append(f"app={rule['app_reference']}")
-    return ", ".join(parts) or rule.get("uid", "")
+    return quota.scope_label(rule, fallback=rule.get("uid", ""))
 
 
 @router.get("/gateway/quota-rules")
@@ -253,6 +246,34 @@ async def save_quota_rule(request: Request):
     return JSONResponse({"ok": True, "rule": saved})
 
 
+@router.post("/gateway/quota-resets")
+async def reset_quota_spend(request: Request):
+    admin = require_admin(request)
+    body = await _payload(request)
+    try:
+        payload = quota.QuotaResetIn(**body)
+    except ValidationError as exc:
+        return _validation_error(exc)
+    scope = quota.reset(payload, created_by=admin["uid"])
+    label = quota.scope_label(scope, fallback="every caller")
+    audit.record(
+        request,
+        "gateway.quota.reset",
+        user=admin,
+        target_type="gateway_quota",
+        target_uid=scope["uid"],
+        target_label=label,
+        summary=f"admin {admin['username']} reset the gateway 24h spend for {label}",
+        metadata={
+            "owner_kind": scope["owner_kind"],
+            "owner_id": scope["owner_id"],
+            "app_reference": scope["app_reference"],
+            "reset_at": scope["reset_at"],
+        },
+    )
+    return JSONResponse({"ok": True, "reset": scope})
+
+
 @router.delete("/gateway/quota-rules/{uid}")
 async def delete_quota_rule(request: Request, uid: str):
     admin = require_admin(request)

devplacepy/routers/profile/index.py

@@ -7,7 +7,6 @@ from devplacepy.models import ProfileForm
 from fastapi.responses import HTMLResponse, JSONResponse
 from devplacepy.database import (
     get_table,
-    db,
     get_customization_prefs,
     get_notification_prefs,
     get_user_stars,
@@ -144,6 +143,8 @@ async def profile_page(
     level_raw = profile_user.get("level") or 1
     xp_progress_pct = xp_raw % LEVEL_XP
     xp_next_level = level_raw * LEVEL_XP
+    profile_user["xp_progress_pct"] = xp_progress_pct
+    profile_user["xp_next_level"] = xp_next_level
     rank = get_user_rank(profile_user["uid"])
     follow_counts = get_follow_counts(profile_user["uid"])
 

devplacepy/routers/projects/index.py

@@ -17,7 +17,6 @@ from devplacepy.database import (
     get_reactions_by_targets,
     get_user_bookmarks,
     get_polls_by_post_uids,
-    get_project_devlog,
     paginate,
     text_search_clause,
     resolve_by_slug,
@@ -40,6 +39,7 @@ from devplacepy.content import (
     is_owner,
     can_view_project,
     can_view_project_containers,
+    get_project_devlog,
 )
 from devplacepy.utils import (
     get_current_user,