v0.3.1: bearer-token reads; public skill + capabilities

Fixes an inconsistency an agent hit: it could POST/PATCH/DELETE with its token
but GET (readback) required a session and 302-redirected to the browser login.

- GET /api/artifacts and GET /api/artifacts/{id} now accept a bearer token OR
  a session, owner-scoped (a token reads only its owner's artifacts). Agents
  can read back what they posted with the same token.
- Unauthenticated API requests return a JSON 403, never a browser-login
  redirect (resolve_request_user helper; dropped @login_required on the JSON
  read views).
- GET /api/skill and GET /api/capabilities are now public (no user data), so
  an agent can fetch the contract + posting instructions before it has a key.
- Docs (api.md, CLAUDE.md) updated; tests for bearer readback, owner-scoping,
  and the JSON-403-not-redirect behavior. Suite: 132 passing; verified live.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -9,6 +9,17 @@ former name, "Daybook".)
 
 _Nothing yet._
 
+## [0.3.1] — 2026-09-04
+
+### Changed
+- Artifact **read** endpoints (`GET /api/artifacts`, `GET /api/artifacts/{id}`)
+  now accept a bearer token as well as a browser session, owner-scoped — an
+  agent can read back what it posted with the same token. Unauthenticated API
+  requests return a JSON `403` instead of a 302 redirect to the browser login.
+- `GET /api/skill` and `GET /api/capabilities` are now **public** (no auth) —
+  they expose no user data, so an agent can fetch the contract and posting
+  instructions before it has a key.
+
 ## [0.3.0] — 2026-09-04
 
 ### Changed
@@ -117,7 +128,8 @@ First tagged release.
 - Dockerised (Gunicorn + whitenoise), SQLite, `git`-based deploy with a
   runbook (`deploy/cloud_agent_deploy.md`) and health check.
 
-[Unreleased]: https://git.cygnus.systems/peter/daybook/compare/v0.3.0...HEAD
+[Unreleased]: https://git.cygnus.systems/peter/daybook/compare/v0.3.1...HEAD
+[0.3.1]: https://git.cygnus.systems/peter/daybook/compare/v0.3.0...v0.3.1
 [0.3.0]: https://git.cygnus.systems/peter/daybook/compare/v0.2.1...v0.3.0
 [0.2.1]: https://git.cygnus.systems/peter/daybook/compare/v0.2.0...v0.2.1
 [0.2.0]: https://git.cygnus.systems/peter/daybook/compare/v0.1.1...v0.2.0