Release v0.2.0: multiple named API keys per user

Replaces the single per-user DRF token with named, individually-revocable
API keys, so you can run one key per agent and cut off a leaked one without
disrupting the others.

- New ApiKey model (user, name, dbk_-prefixed key, created_at, last_used_at).
  Data migration copies every existing authtoken 1:1 into a "default" named
  key with the same value, so no client (incl. the sibling test project's
  hardcoded test-user key) needs reconfiguring.
- Auth (resolve_token_user) resolves against ApiKey and stamps last_used_at,
  throttled to one write/minute.
- Settings -> API Keys: table with name/key/created/last-used + per-row
  revoke and a create form; keys viewable on demand. Settings -> Account now
  links here; Settings -> Users issues a named initial key.
- Gated provisioning API for test installations: GET/POST /api/keys and
  DELETE /api/keys/{id}, controlled by DAYBOOK_KEY_PROVISIONING_API (unset ->
  follows DEBUG, so off in deployment). Advertised via key_provisioning_api
  in /api/capabilities; 403 when disabled.
- Docs (api/deployment/quickstart/posting-helper), SKILL.md, and env.example
  updated from "token / Settings -> Account" to "key / Settings -> API Keys".
- Tests: new API + UI suites for keys; existing token-based tests moved to
  ApiKey. Full suite 129 passing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

templates/artifacts/settings_account.html

@@ -4,12 +4,10 @@
   <h2>Account</h2>
   <p><strong>Username:</strong> {{ request.user.username }}</p>
 
-  <h3>API Token</h3>
-  <p>Use this token as <code>Authorization: Bearer &lt;token&gt;</code> when posting artifacts.</p>
-  <p><code class="token-value">{{ token.key }}</code></p>
-  <form method="post">
-    {% csrf_token %}
-    <input type="hidden" name="action" value="regenerate">
-    <button type="submit">Regenerate Token</button>
-  </form>
+  <h3>API Keys</h3>
+  <p>
+    Posting to Daybook uses named API keys — one per agent or script, each
+    revocable on its own. You have {{ key_count }} key{{ key_count|pluralize }}.
+  </p>
+  <p><a href="{% url 'settings-api-keys' %}">Manage API keys &rarr;</a></p>
 {% endblock %}

templates/artifacts/settings_api_keys.html

@@ -0,0 +1,66 @@
+{% extends "artifacts/settings_base.html" %}
+
+{% block settings_content %}
+  <h2>API Keys</h2>
+  <p>
+    One key per agent or script. Name each key so you know which agent it's
+    for, copy it into that agent's <code>DAYBOOK_TOKEN</code>, and revoke keys
+    individually here. Use a key as
+    <code>Authorization: Bearer &lt;key&gt;</code> when posting.
+  </p>
+
+  <h3>Create a key</h3>
+  <form method="post" class="api-key-create">
+    {% csrf_token %}
+    <input type="hidden" name="action" value="create">
+    <label>Name <input type="text" name="name" placeholder="e.g. hermes-agent" required autocomplete="off"></label>
+    <button type="submit">Create key</button>
+  </form>
+
+  <h3>Your keys</h3>
+  {% if api_keys %}
+    <table class="api-key-table">
+      <thead>
+        <tr><th>Name</th><th>Key</th><th>Created</th><th>Last used</th><th></th></tr>
+      </thead>
+      <tbody>
+        {% for k in api_keys %}
+          <tr>
+            <td>{{ k.name }}</td>
+            <td class="api-key-cell">
+              <code class="token-value">{{ k.key }}</code>
+              <button type="button" class="api-key-copy" data-copy="{{ k.key }}">Copy</button>
+            </td>
+            <td>{{ k.created_at|date:"Y-m-d" }}</td>
+            <td>{% if k.last_used_at %}{{ k.last_used_at|date:"Y-m-d H:i" }}{% else %}<span class="muted">never</span>{% endif %}</td>
+            <td>
+              <form method="post" onsubmit="return confirm('Revoke key &quot;{{ k.name|escapejs }}&quot;? Agents using it will stop working immediately.');">
+                {% csrf_token %}
+                <input type="hidden" name="action" value="revoke">
+                <input type="hidden" name="key_id" value="{{ k.pk }}">
+                <button type="submit" class="api-key-revoke">Revoke</button>
+              </form>
+            </td>
+          </tr>
+        {% endfor %}
+      </tbody>
+    </table>
+  {% else %}
+    <p class="muted">No keys yet. Create one above.</p>
+  {% endif %}
+
+  <script>
+    (() => {
+      document.querySelectorAll(".api-key-copy").forEach((btn) => {
+        btn.addEventListener("click", async () => {
+          try {
+            await navigator.clipboard.writeText(btn.dataset.copy);
+            const prev = btn.textContent;
+            btn.textContent = "Copied";
+            setTimeout(() => { btn.textContent = prev; }, 1200);
+          } catch (e) { /* clipboard unavailable; the key is visible to select manually */ }
+        });
+      });
+    })();
+  </script>
+{% endblock %}

templates/artifacts/settings_base.html

@@ -25,6 +25,7 @@
     <nav class="settings-nav">
       <a class="settings-nav-back" href="{% url 'feed' %}">&larr; Back to Feed</a>
       <a class="{% if active_section == 'account' %}selected{% endif %}" href="{% url 'settings-account' %}">Account</a>
+      <a class="{% if active_section == 'api-keys' %}selected{% endif %}" href="{% url 'settings-api-keys' %}">API Keys</a>
       <a class="{% if active_section == 'storage' %}selected{% endif %}" href="{% url 'settings-storage' %}">Storage</a>
       <a class="{% if active_section == 'demo-data' %}selected{% endif %}" href="{% url 'settings-demo-data' %}">Demo Data</a>
       {% if request.user.is_superuser %}

templates/artifacts/settings_users.html

@@ -3,13 +3,14 @@
 {% block settings_content %}
   <h2>Users</h2>
 
-  {% if created_token %}
-    <p><strong>API token for {{ created_user.username }}</strong> — shown once, copy it now:</p>
-    <p><code class="token-value">{{ created_token.key }}</code></p>
+  {% if created_key %}
+    <p><strong>API key for {{ created_user.username }}</strong> (named "{{ created_key.name }}") — copy it now:</p>
+    <p><code class="token-value">{{ created_key.key }}</code></p>
+    <p class="muted">They can view, rename via new keys, and revoke it from Settings &rarr; API Keys.</p>
   {% endif %}
 
   <h3>Add User</h3>
-  <p>New users are regular accounts by default — they can log in and use their own token, but cannot reach Django admin unless you grant admin access below.</p>
+  <p>New users are regular accounts by default — they can log in and use their own API keys, but cannot reach Django admin unless you grant admin access below.</p>
   <form method="post">
     {% csrf_token %}
     <p><label>Username<br><input type="text" name="username" required autocomplete="off"></label></p>