feat: add project file system with CRUD, upload, inline editing, and video attachment support

- Add new `/projects/{slug}/files` endpoint group for per-project filesystem operations including directory and file CRUD, upload, and inline editing with public read and owner write access
- Extend attachment system to support video formats (webm, ogv, mov, m4v) with proper file icons and MIME types
- Implement configurable allowed file types via `allowed_file_types` site setting, replacing hardcoded `ALLOWED_UPLOAD_TYPES` with dynamic `allowed_extensions()` and `is_extension_allowed()` functions
- Add `delete_all_project_files()` call in `delete_content_item()` to clean up project files when a project is deleted
- Create database indexes on `project_files` table for `(project_uid, path)` and `(project_uid, parent_path)` to optimize file lookups
- Introduce `docs_prose.py` module with `render_prose()` function that renders Markdown content inside `data-render` divs using mistune, enabling dynamic prose rendering in documentation pages
- Enhance docs search with Markdown-aware text stripping (`_demarkdown()`) and improved HTML/script/style sanitization for better search indexing
- Update documentation API samples to reflect new attachment response fields (`is_image`, `is_video`, `mime_type`) and note video format support
- Update README to document the new project files endpoint and clarify AI gateway attribution for guest Devii sessions

devplacepy/services/openai_gateway/service.py

@@ -46,8 +46,8 @@ class GatewayService(BaseService):
         ConfigField("gateway_api_key", "Upstream API key", type="str", default="",
                     help="The key currently in use; auto-migrated from DEEPSEEK_API_KEY or OPENROUTER_API_KEY on boot. Editable.",
                     group="Upstream"),
-        ConfigField("gateway_timeout", "Upstream timeout (seconds)", type="int", default=config.TIMEOUT_DEFAULT, minimum=1,
-                    help="Per-request upstream timeout.", group="Upstream"),
+        ConfigField("gateway_timeout", "Upstream timeout (seconds)", type="int", default=config.TIMEOUT_DEFAULT, minimum=config.TIMEOUT_MIN,
+                    help="Per-request upstream timeout. Minimum five minutes.", group="Upstream"),
         ConfigField("gateway_instances", "Instances (concurrency)", type="int",
                     default=config.INSTANCES_DEFAULT, minimum=1, maximum=64,
                     help="Max concurrent upstream forwards per worker (connection pool + semaphore).",
@@ -68,8 +68,10 @@ class GatewayService(BaseService):
                     help="When off, the gateway is open to anyone.", group="Access"),
         ConfigField("gateway_allow_admins", "Allow admins", type="bool", default=True,
                     help="Admin users (API key / Bearer / Basic / session) may call the gateway.", group="Access"),
-        ConfigField("gateway_allow_users", "Allow users", type="bool", default=False,
-                    help="Any authenticated user may call the gateway.", group="Access"),
+        ConfigField("gateway_allow_users", "Allow users", type="bool", default=True,
+                    help="Any authenticated user may call the gateway with their own API key. "
+                         "Devii operates a signed-in user's account with that user's key, so usage is "
+                         "attributed and limitable per user.", group="Access"),
         ConfigField("gateway_access_key", "Static access key", type="password", default="", secret=True,
                     help="A standalone key that always grants access (sent as X-API-KEY or Bearer).",
                     group="Access"),