Release v0.2.0: multiple named API keys per user

Replaces the single per-user DRF token with named, individually-revocable
API keys, so you can run one key per agent and cut off a leaked one without
disrupting the others.

- New ApiKey model (user, name, dbk_-prefixed key, created_at, last_used_at).
  Data migration copies every existing authtoken 1:1 into a "default" named
  key with the same value, so no client (incl. the sibling test project's
  hardcoded test-user key) needs reconfiguring.
- Auth (resolve_token_user) resolves against ApiKey and stamps last_used_at,
  throttled to one write/minute.
- Settings -> API Keys: table with name/key/created/last-used + per-row
  revoke and a create form; keys viewable on demand. Settings -> Account now
  links here; Settings -> Users issues a named initial key.
- Gated provisioning API for test installations: GET/POST /api/keys and
  DELETE /api/keys/{id}, controlled by DAYBOOK_KEY_PROVISIONING_API (unset ->
  follows DEBUG, so off in deployment). Advertised via key_provisioning_api
  in /api/capabilities; 403 when disabled.
- Docs (api/deployment/quickstart/posting-helper), SKILL.md, and env.example
  updated from "token / Settings -> Account" to "key / Settings -> API Keys".
- Tests: new API + UI suites for keys; existing token-based tests moved to
  ApiKey. Full suite 129 passing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

artifacts/migrations/0014_apikey.py

@@ -0,0 +1,31 @@
+# Generated by Django 5.2.15 on 2026-09-04 09:35
+
+import artifacts.models
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('artifacts', '0013_artifact_share_token'),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='ApiKey',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('name', models.CharField(max_length=100)),
+                ('key', models.CharField(db_index=True, default=artifacts.models.generate_api_key, max_length=64, unique=True)),
+                ('created_at', models.DateTimeField(auto_now_add=True)),
+                ('last_used_at', models.DateTimeField(blank=True, null=True)),
+                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='api_keys', to=settings.AUTH_USER_MODEL)),
+            ],
+            options={
+                'ordering': ['created_at'],
+            },
+        ),
+    ]

artifacts/migrations/0015_migrate_tokens_to_apikeys.py

@@ -0,0 +1,32 @@
+from django.db import migrations
+
+
+def copy_tokens_to_apikeys(apps, schema_editor):
+    """Carry every existing DRF authtoken over to a named ApiKey so keys issued
+    before the multi-key feature keep authenticating (incl. the permanent test
+    user and any deployed agents). Same key string -> no client reconfiguration."""
+    Token = apps.get_model("authtoken", "Token")
+    ApiKey = apps.get_model("artifacts", "ApiKey")
+    for token in Token.objects.all():
+        if ApiKey.objects.filter(key=token.key).exists():
+            continue
+        api_key = ApiKey.objects.create(user_id=token.user_id, name="default", key=token.key)
+        # created_at is auto_now_add, so set it after the fact to preserve the
+        # original issue date (queryset.update bypasses auto_now_add).
+        ApiKey.objects.filter(pk=api_key.pk).update(created_at=token.created)
+
+
+def noop(apps, schema_editor):
+    pass
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("artifacts", "0014_apikey"),
+        ("authtoken", "0004_alter_tokenproxy_options"),
+    ]
+
+    operations = [
+        migrations.RunPython(copy_tokens_to_apikeys, noop),
+    ]