Release v0.2.0: multiple named API keys per user

Replaces the single per-user DRF token with named, individually-revocable
API keys, so you can run one key per agent and cut off a leaked one without
disrupting the others.

- New ApiKey model (user, name, dbk_-prefixed key, created_at, last_used_at).
  Data migration copies every existing authtoken 1:1 into a "default" named
  key with the same value, so no client (incl. the sibling test project's
  hardcoded test-user key) needs reconfiguring.
- Auth (resolve_token_user) resolves against ApiKey and stamps last_used_at,
  throttled to one write/minute.
- Settings -> API Keys: table with name/key/created/last-used + per-row
  revoke and a create form; keys viewable on demand. Settings -> Account now
  links here; Settings -> Users issues a named initial key.
- Gated provisioning API for test installations: GET/POST /api/keys and
  DELETE /api/keys/{id}, controlled by DAYBOOK_KEY_PROVISIONING_API (unset ->
  follows DEBUG, so off in deployment). Advertised via key_provisioning_api
  in /api/capabilities; 403 when disabled.
- Docs (api/deployment/quickstart/posting-helper), SKILL.md, and env.example
  updated from "token / Settings -> Account" to "key / Settings -> API Keys".
- Tests: new API + UI suites for keys; existing token-based tests moved to
  ApiKey. Full suite 129 passing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/api/test_api_keys.py

@@ -0,0 +1,109 @@
+from django.contrib.auth import get_user_model
+from django.test import override_settings
+from django.urls import reverse
+from rest_framework.test import APITestCase
+
+from artifacts.models import ApiKey
+
+User = get_user_model()
+
+
+@override_settings(DAYBOOK_KEY_PROVISIONING_API=True)
+class ApiKeyProvisioningEnabledTestCase(APITestCase):
+    def setUp(self):
+        self.user = User.objects.create_user(username="alice", password="pw")
+        self.bootstrap = ApiKey.objects.create(user=self.user, name="bootstrap")
+        self.other = User.objects.create_user(username="bob", password="pw")
+
+    def auth(self, key):
+        return {"HTTP_AUTHORIZATION": f"Bearer {key.key}"}
+
+    def test_create_key_with_token_auth(self):
+        response = self.client.post(
+            reverse("api-keys"), {"name": "hermes-agent"}, format="json", **self.auth(self.bootstrap)
+        )
+        self.assertEqual(response.status_code, 201)
+        self.assertEqual(response.data["name"], "hermes-agent")
+        self.assertTrue(response.data["key"].startswith("dbk_"))
+        self.assertTrue(ApiKey.objects.filter(user=self.user, name="hermes-agent").exists())
+
+    def test_created_key_can_authenticate(self):
+        created = self.client.post(
+            reverse("api-keys"), {"name": "worker"}, format="json", **self.auth(self.bootstrap)
+        ).data
+        # The brand-new key works against another token-authed endpoint.
+        response = self.client.get(
+            reverse("capabilities-api"), HTTP_AUTHORIZATION=f"Bearer {created['key']}"
+        )
+        self.assertEqual(response.status_code, 200)
+
+    def test_create_requires_name(self):
+        response = self.client.post(
+            reverse("api-keys"), {"name": "  "}, format="json", **self.auth(self.bootstrap)
+        )
+        self.assertEqual(response.status_code, 400)
+
+    def test_list_returns_only_own_keys(self):
+        ApiKey.objects.create(user=self.other, name="not-yours")
+        response = self.client.get(reverse("api-keys"), **self.auth(self.bootstrap))
+        self.assertEqual(response.status_code, 200)
+        names = {k["name"] for k in response.data}
+        self.assertEqual(names, {"bootstrap"})
+
+    def test_revoke_key(self):
+        victim = ApiKey.objects.create(user=self.user, name="doomed")
+        response = self.client.delete(
+            reverse("api-key-detail", args=[victim.pk]), **self.auth(self.bootstrap)
+        )
+        self.assertEqual(response.status_code, 204)
+        self.assertFalse(ApiKey.objects.filter(pk=victim.pk).exists())
+
+    def test_revoke_one_does_not_affect_others(self):
+        keep = ApiKey.objects.create(user=self.user, name="keep")
+        drop = ApiKey.objects.create(user=self.user, name="drop")
+        self.client.delete(reverse("api-key-detail", args=[drop.pk]), **self.auth(self.bootstrap))
+        self.assertTrue(ApiKey.objects.filter(pk=keep.pk).exists())
+
+    def test_cannot_revoke_another_users_key(self):
+        theirs = ApiKey.objects.create(user=self.other, name="theirs")
+        response = self.client.delete(
+            reverse("api-key-detail", args=[theirs.pk]), **self.auth(self.bootstrap)
+        )
+        self.assertEqual(response.status_code, 404)
+        self.assertTrue(ApiKey.objects.filter(pk=theirs.pk).exists())
+
+    def test_capabilities_advertises_provisioning(self):
+        response = self.client.get(reverse("capabilities-api"), **self.auth(self.bootstrap))
+        self.assertTrue(response.data["key_provisioning_api"])
+        self.assertEqual(response.data["methods"]["/api/keys"], ["GET", "POST"])
+
+
+@override_settings(DAYBOOK_KEY_PROVISIONING_API=False)
+class ApiKeyProvisioningDisabledTestCase(APITestCase):
+    def setUp(self):
+        self.user = User.objects.create_user(username="alice", password="pw")
+        self.key = ApiKey.objects.create(user=self.user, name="bootstrap")
+
+    def auth(self):
+        return {"HTTP_AUTHORIZATION": f"Bearer {self.key.key}"}
+
+    def test_create_disabled_returns_403(self):
+        response = self.client.post(
+            reverse("api-keys"), {"name": "nope"}, format="json", **self.auth()
+        )
+        self.assertEqual(response.status_code, 403)
+        self.assertFalse(ApiKey.objects.filter(name="nope").exists())
+
+    def test_list_disabled_returns_403(self):
+        response = self.client.get(reverse("api-keys"), **self.auth())
+        self.assertEqual(response.status_code, 403)
+
+    def test_revoke_disabled_returns_403(self):
+        response = self.client.delete(reverse("api-key-detail", args=[self.key.pk]), **self.auth())
+        self.assertEqual(response.status_code, 403)
+        self.assertTrue(ApiKey.objects.filter(pk=self.key.pk).exists())
+
+    def test_capabilities_hides_provisioning(self):
+        response = self.client.get(reverse("capabilities-api"), **self.auth())
+        self.assertFalse(response.data["key_provisioning_api"])
+        self.assertNotIn("/api/keys", response.data["methods"])