Release v0.2.0: multiple named API keys per user

Replaces the single per-user DRF token with named, individually-revocable
API keys, so you can run one key per agent and cut off a leaked one without
disrupting the others.

- New ApiKey model (user, name, dbk_-prefixed key, created_at, last_used_at).
  Data migration copies every existing authtoken 1:1 into a "default" named
  key with the same value, so no client (incl. the sibling test project's
  hardcoded test-user key) needs reconfiguring.
- Auth (resolve_token_user) resolves against ApiKey and stamps last_used_at,
  throttled to one write/minute.
- Settings -> API Keys: table with name/key/created/last-used + per-row
  revoke and a create form; keys viewable on demand. Settings -> Account now
  links here; Settings -> Users issues a named initial key.
- Gated provisioning API for test installations: GET/POST /api/keys and
  DELETE /api/keys/{id}, controlled by DAYBOOK_KEY_PROVISIONING_API (unset ->
  follows DEBUG, so off in deployment). Advertised via key_provisioning_api
  in /api/capabilities; 403 when disabled.
- Docs (api/deployment/quickstart/posting-helper), SKILL.md, and env.example
  updated from "token / Settings -> Account" to "key / Settings -> API Keys".
- Tests: new API + UI suites for keys; existing token-based tests moved to
  ApiKey. Full suite 129 passing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

artifacts/models.py

@@ -1,7 +1,14 @@
+import secrets
+
 from django.conf import settings
 from django.db import models
 
 
+def generate_api_key():
+    """`dbk_` prefix (recognizable as a Daybook key) + 40 hex chars."""
+    return "dbk_" + secrets.token_hex(20)
+
+
 class Artifact(models.Model):
     HTML_FRAGMENT = "html_fragment"
     HTML_FULL = "html_full"
@@ -92,6 +99,28 @@ class UserProfile(models.Model):
         return f"{self.user} quota={self.quota_bytes}"
 
 
+class ApiKey(models.Model):
+    """A named, per-user API key for ingest. A user can hold several — one per
+    agent or script — and revoke them individually. Stored and shown in
+    plaintext: this is a self-hosted, single-operator app and keys are
+    viewable on demand by design.
+    """
+
+    user = models.ForeignKey(
+        settings.AUTH_USER_MODEL, on_delete=models.CASCADE, related_name="api_keys"
+    )
+    name = models.CharField(max_length=100)
+    key = models.CharField(max_length=64, unique=True, default=generate_api_key, db_index=True)
+    created_at = models.DateTimeField(auto_now_add=True)
+    last_used_at = models.DateTimeField(null=True, blank=True)
+
+    class Meta:
+        ordering = ["created_at"]
+
+    def __str__(self):
+        return f"{self.name} ({self.user})"
+
+
 class Asset(models.Model):
     """An image uploaded for embedding inside an artifact's content.