Release v0.2.0: multiple named API keys per user

Replaces the single per-user DRF token with named, individually-revocable
API keys, so you can run one key per agent and cut off a leaked one without
disrupting the others.

- New ApiKey model (user, name, dbk_-prefixed key, created_at, last_used_at).
  Data migration copies every existing authtoken 1:1 into a "default" named
  key with the same value, so no client (incl. the sibling test project's
  hardcoded test-user key) needs reconfiguring.
- Auth (resolve_token_user) resolves against ApiKey and stamps last_used_at,
  throttled to one write/minute.
- Settings -> API Keys: table with name/key/created/last-used + per-row
  revoke and a create form; keys viewable on demand. Settings -> Account now
  links here; Settings -> Users issues a named initial key.
- Gated provisioning API for test installations: GET/POST /api/keys and
  DELETE /api/keys/{id}, controlled by DAYBOOK_KEY_PROVISIONING_API (unset ->
  follows DEBUG, so off in deployment). Advertised via key_provisioning_api
  in /api/capabilities; 403 when disabled.
- Docs (api/deployment/quickstart/posting-helper), SKILL.md, and env.example
  updated from "token / Settings -> Account" to "key / Settings -> API Keys".
- Tests: new API + UI suites for keys; existing token-based tests moved to
  ApiKey. Full suite 129 passing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -8,6 +8,28 @@ the git tags (`vX.Y.Z`) and `daybook_project.__version__`.
 
 _Nothing yet._
 
+## [0.2.0] — 2026-09-04
+
+### Added
+- **Multiple named API keys per user.** Each user can now hold several keys —
+  one per agent or script — named and revocable individually, managed from a
+  new **Settings → API Keys** page (a table with name, key, created, last-used,
+  and per-row revoke). Keys are viewable on demand (`dbk_`-prefixed).
+- **Gated key-provisioning API** for automated test installations:
+  `GET/POST /api/keys` and `DELETE /api/keys/{id}`, controlled by
+  `DAYBOOK_KEY_PROVISIONING_API` (unset → follows `DJANGO_DEBUG`, so **off in
+  deployment**). Advertised as `key_provisioning_api` in `/api/capabilities`;
+  returns 403 when disabled.
+- API keys track `last_used_at` (throttled to one write/minute) so stale keys
+  are visible before you revoke them.
+
+### Changed
+- Auth now resolves bearer tokens against the new `ApiKey` model instead of the
+  single DRF `authtoken.Token`. Existing tokens are migrated 1:1 into named
+  ("default") keys with the same value — no client reconfiguration needed.
+- Settings → Account no longer manages a single token; it links to API Keys.
+  Creating a user (Settings → Users) issues an initial named key.
+
 ## [0.1.1] — 2026-09-03
 
 ### Fixed
@@ -63,6 +85,7 @@ First tagged release.
 - Dockerised (Gunicorn + whitenoise), SQLite, `git`-based deploy with a
   runbook (`deploy/cloud_agent_deploy.md`) and health check.
 
-[Unreleased]: https://git.cygnus.systems/peter/daybook/compare/v0.1.1...HEAD
+[Unreleased]: https://git.cygnus.systems/peter/daybook/compare/v0.2.0...HEAD
+[0.2.0]: https://git.cygnus.systems/peter/daybook/compare/v0.1.1...v0.2.0
 [0.1.1]: https://git.cygnus.systems/peter/daybook/compare/v0.1.0...v0.1.1
 [0.1.0]: https://git.cygnus.systems/peter/daybook/releases/tag/v0.1.0