Release v0.2.0: multiple named API keys per user

Replaces the single per-user DRF token with named, individually-revocable
API keys, so you can run one key per agent and cut off a leaked one without
disrupting the others.

- New ApiKey model (user, name, dbk_-prefixed key, created_at, last_used_at).
  Data migration copies every existing authtoken 1:1 into a "default" named
  key with the same value, so no client (incl. the sibling test project's
  hardcoded test-user key) needs reconfiguring.
- Auth (resolve_token_user) resolves against ApiKey and stamps last_used_at,
  throttled to one write/minute.
- Settings -> API Keys: table with name/key/created/last-used + per-row
  revoke and a create form; keys viewable on demand. Settings -> Account now
  links here; Settings -> Users issues a named initial key.
- Gated provisioning API for test installations: GET/POST /api/keys and
  DELETE /api/keys/{id}, controlled by DAYBOOK_KEY_PROVISIONING_API (unset ->
  follows DEBUG, so off in deployment). Advertised via key_provisioning_api
  in /api/capabilities; 403 when disabled.
- Docs (api/deployment/quickstart/posting-helper), SKILL.md, and env.example
  updated from "token / Settings -> Account" to "key / Settings -> API Keys".
- Tests: new API + UI suites for keys; existing token-based tests moved to
  ApiKey. Full suite 129 passing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

skills/daybook-posting/SKILL.md

@@ -18,7 +18,7 @@ support; a `.env` file in the working directory is not read automatically.
 
 ```text
 DAYBOOK_URL=https://your-daybook-instance.example.com   # your server's base URL
-DAYBOOK_TOKEN=your-personal-api-token                   # from Settings -> Account
+DAYBOOK_TOKEN=your-personal-api-key                     # from Settings -> API Keys
 DAYBOOK_SOURCE=agent                                    # a stable label for what's posting
 ```
 
@@ -27,9 +27,9 @@ DAYBOOK_SOURCE=agent                                    # a stable label for wha
   `http://127.0.0.1:8001`, which is only correct when Daybook is running
   locally on the same machine (its development default). For any remote or
   deployed instance you **must** set this.
-- **`DAYBOOK_TOKEN`** — your personal per-user API token, from Settings →
-  Account in the app (not a token shared by everyone). Artifacts posted with
-  your token land only in your feed.
+- **`DAYBOOK_TOKEN`** — a personal API key, created in the app under Settings →
+  API Keys (name one per agent so you can revoke them individually). Not a key
+  shared by everyone; artifacts posted with it land only in your feed.
 - **`DAYBOOK_SOURCE`** — a free-text label for whatever is posting
   (agent-profile, script, or person name). Optional; can also be passed per
   call with `--source`.