Release v0.2.0: multiple named API keys per user

Replaces the single per-user DRF token with named, individually-revocable
API keys, so you can run one key per agent and cut off a leaked one without
disrupting the others.

- New ApiKey model (user, name, dbk_-prefixed key, created_at, last_used_at).
  Data migration copies every existing authtoken 1:1 into a "default" named
  key with the same value, so no client (incl. the sibling test project's
  hardcoded test-user key) needs reconfiguring.
- Auth (resolve_token_user) resolves against ApiKey and stamps last_used_at,
  throttled to one write/minute.
- Settings -> API Keys: table with name/key/created/last-used + per-row
  revoke and a create form; keys viewable on demand. Settings -> Account now
  links here; Settings -> Users issues a named initial key.
- Gated provisioning API for test installations: GET/POST /api/keys and
  DELETE /api/keys/{id}, controlled by DAYBOOK_KEY_PROVISIONING_API (unset ->
  follows DEBUG, so off in deployment). Advertised via key_provisioning_api
  in /api/capabilities; 403 when disabled.
- Docs (api/deployment/quickstart/posting-helper), SKILL.md, and env.example
  updated from "token / Settings -> Account" to "key / Settings -> API Keys".
- Tests: new API + UI suites for keys; existing token-based tests moved to
  ApiKey. Full suite 129 passing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/views/test_settings_api_keys.py

@@ -0,0 +1,45 @@
+from django.contrib.auth import get_user_model
+from django.test import TestCase
+from django.urls import reverse
+
+from artifacts.models import ApiKey
+
+User = get_user_model()
+
+
+class SettingsApiKeysViewTestCase(TestCase):
+    def setUp(self):
+        self.user = User.objects.create_user(username="alice", password="pw")
+        self.client.force_login(self.user)
+
+    def test_requires_login(self):
+        self.client.logout()
+        response = self.client.get(reverse("settings-api-keys"))
+        self.assertEqual(response.status_code, 302)
+
+    def test_create_key(self):
+        response = self.client.post(
+            reverse("settings-api-keys"), {"action": "create", "name": "hermes-agent"}, follow=True
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertTrue(ApiKey.objects.filter(user=self.user, name="hermes-agent").exists())
+
+    def test_create_requires_name(self):
+        self.client.post(reverse("settings-api-keys"), {"action": "create", "name": "  "})
+        self.assertFalse(self.user.api_keys.exists())
+
+    def test_key_value_is_viewable_in_list(self):
+        key = ApiKey.objects.create(user=self.user, name="visible")
+        response = self.client.get(reverse("settings-api-keys"))
+        self.assertContains(response, key.key)  # view-anytime: full key rendered
+
+    def test_revoke_key(self):
+        key = ApiKey.objects.create(user=self.user, name="doomed")
+        self.client.post(reverse("settings-api-keys"), {"action": "revoke", "key_id": key.pk})
+        self.assertFalse(ApiKey.objects.filter(pk=key.pk).exists())
+
+    def test_cannot_revoke_another_users_key(self):
+        other = User.objects.create_user(username="bob", password="pw")
+        theirs = ApiKey.objects.create(user=other, name="theirs")
+        self.client.post(reverse("settings-api-keys"), {"action": "revoke", "key_id": theirs.pk})
+        self.assertTrue(ApiKey.objects.filter(pk=theirs.pk).exists())

tests/views/test_settings_users.py

@@ -1,7 +1,7 @@
 from django.contrib.auth import get_user_model
 from django.test import TestCase
 from django.urls import reverse
-from rest_framework.authtoken.models import Token
+from artifacts.models import ApiKey
 
 User = get_user_model()
 
@@ -38,8 +38,8 @@ class SettingsUsersViewTestCase(TestCase):
         self.assertTrue(created.check_password("hunter2pw"))
         self.assertFalse(created.is_superuser)
         self.assertFalse(created.is_staff)
-        self.assertTrue(Token.objects.filter(user=created).exists())
-        self.assertContains(response, Token.objects.get(user=created).key)
+        self.assertTrue(ApiKey.objects.filter(user=created).exists())
+        self.assertContains(response, ApiKey.objects.get(user=created).key)
 
     def test_superuser_can_grant_admin(self):
         self.client.force_login(self.admin)

tests/views/test_sharing.py

@@ -6,9 +6,8 @@ from django.contrib.auth import get_user_model
 from django.test import TestCase, override_settings
 from django.urls import reverse
 from django.utils import timezone
-from rest_framework.authtoken.models import Token
 
-from artifacts.models import Artifact, Asset
+from artifacts.models import ApiKey, Artifact, Asset
 
 User = get_user_model()
 
@@ -173,7 +172,7 @@ class SharingTestCase(TestCase):
     # -- API surface --------------------------------------------------------
 
     def test_api_detail_reports_share_status(self):
-        token = Token.objects.create(user=self.owner)
+        token = ApiKey.objects.create(user=self.owner, name="owner-key")
         self.client.force_login(self.owner)
         self.toggle_share(self.client)
         self.artifact.refresh_from_db()