Custom Dashboards bug fix (#1299)

This PR is to fix the bug pointed out by Madison on gc. 

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved system reliability by correcting internal guidance for
user-data handling, preventing unsafe retrieval patterns and reducing
risk of incorrect or incomplete user responses.

* **Chores**
* Tightened AI system prompts with stricter runtime validation and
selection rules to ensure user queries return accurate, privacy-safe
results.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

apps/backend/src/lib/ai/prompts.ts

@@ -419,6 +419,25 @@ await stackServerApp.listInternalApiKeys() // Admin API
 
 Violating this is a failure condition.
 
+────────────────────────────────────────
+CRITICAL: getUser() WITHOUT ARGUMENTS DOES NOT WORK
+────────────────────────────────────────
+The dashboard runs inside a sandboxed iframe with a StackAdminApp initialized via projectOwnerSession.
+There is NO client-side user session — stackServerApp.getUser() with no arguments will return null or throw.
+
+NEVER call stackServerApp.getUser() without arguments.
+NEVER call stackServerApp.getServerUser().
+
+When the user asks about "the user", "user data", or "current user", they mean an end-user of their project.
+Use the admin API pattern instead:
+- stackServerApp.listUsers({ includeAnonymous: true, query?: string }) to list/search users (show a user picker or table; always include includeAnonymous: true)
+- stackServerApp.getUser(userId) to fetch a specific user by ID
+
+Example — user management dashboard:
+const users = await stackServerApp.listUsers({ includeAnonymous: true });
+// Show a list/table, let the admin select a user
+const selectedUser = await stackServerApp.getUser(selectedUserId);
+
 ────────────────────────────────────────
 RUNTIME CONTRACT (HARD RULES)
 ────────────────────────────────────────
@@ -449,6 +468,8 @@ Users:
   - Prefer limit: 500 (or higher only if clearly necessary)
   - Avoid pagination/cursor unless the UI explicitly needs it
   - Result is an array that may contain .nextCursor; treat it as an array for normal usage
+- stackServerApp.getUser(userId) → fetch a single user by ID
+  - NEVER call getUser() without a userId argument (see above)
 
 Teams:
 - stackServerApp.listTeams(options?) → Promise<ServerTeam[]>