Add multi-user auth, settings area, and unified label feed

Turns Daybook into a multi-user tool and reworks the feed UI:

- Multi-user: Django session login (username/password + remember-me),
  per-user personal API tokens (DRF authtoken), whole app gated behind
  login. Each artifact has an owner; feeds are private per user.
- Rename persona -> source (free-text label for whatever posted an
  artifact: agent-profile, script, or person). source + tags form one
  unified label system; single label filter matches tags, source has
  its own filter/column/sidebar.
- Settings area (gear/user menu, top-right): Account (view/regenerate
  token) and Demo Data (in-app button seeding one artifact per kind).
  User account management via Django admin (superusers only).
- Feed rework: rolling 7-day window with sticky inline date separators
  and infinite scroll; left sidebar is now a Sources list with per-source
  unread counts; artifact type shown as text after title; source in its
  own column.
- Unread tracking: read_at on Artifact, marked read when previewed,
  bold titles for unread, sidebar unread badges, old banner removed.
- Tag colours: global shared registry, hash-based default with optional
  per-tag override via tag_colors on POST/PATCH.
- Ingest: token resolves owner; same source name under two users' tokens
  stays isolated. daybook_post.py renamed persona->source, requires a
  real token, --check accepts a bearer token. Docs updated to match.

Migrations 0004-0008 rename persona, add owner (nullable -> backfill to
first superuser -> required), and add read_at. Fresh installs no-op the
backfill.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/agent_quickstart.md

@@ -2,17 +2,26 @@
 
 This is the shortest path for an agent to publish and retrieve artifacts from Daybook.
 
+## 0. Get Your API Token
+
+Log in to the app in a browser and copy your personal token from **Settings → Account**
+(`http://127.0.0.1:8001/settings/account/`). Every artifact you post with it lands in your
+feed, and only yours.
+
 ## 1. Check Capabilities
 
+Also confirms your token is valid:
+
 ```powershell
-Invoke-RestMethod "http://127.0.0.1:8001/api/capabilities"
+Invoke-RestMethod "http://127.0.0.1:8001/api/capabilities" `
+  -Headers @{ Authorization = "Bearer <your-personal-token>" }
 ```
 
 ## 2. Publish Markdown
 
 ```powershell
 $body = @{
-  persona = "hermes"
+  source = "hermes-research"
   source_type = "agent"
   source_name = "Hermes Agent"
   source_id = "hermes-local"
@@ -29,7 +38,7 @@ $body = @{
 $artifact = Invoke-RestMethod `
   -Uri "http://127.0.0.1:8001/api/artifacts" `
   -Method Post `
-  -Headers @{ Authorization = "Bearer dev-token" } `
+  -Headers @{ Authorization = "Bearer <your-personal-token>" } `
   -ContentType "application/json" `
   -Body $body
 
@@ -46,7 +55,7 @@ $artifact.url
 
 ```powershell
 $body = @{
-  persona = "athena"
+  source = "athena"
   source_type = "agent"
   source_name = "Athena Agent"
   kind = "html_fragment"
@@ -59,7 +68,7 @@ $body = @{
 Invoke-RestMethod `
   -Uri "http://127.0.0.1:8001/api/artifacts" `
   -Method Post `
-  -Headers @{ Authorization = "Bearer dev-token" } `
+  -Headers @{ Authorization = "Bearer <your-personal-token>" } `
   -ContentType "application/json" `
   -Body $body
 ```
@@ -68,8 +77,8 @@ Invoke-RestMethod `
 
 ```powershell
 curl.exe -X POST "http://127.0.0.1:8001/api/artifacts" `
-  -H "Authorization: Bearer dev-token" `
-  -F "persona=orion" `
+  -H "Authorization: Bearer <your-personal-token>" `
+  -F "source=orion" `
   -F "source_type=agent" `
   -F "source_name=Orion Agent" `
   -F "title=Generated PDF" `
@@ -79,8 +88,13 @@ curl.exe -X POST "http://127.0.0.1:8001/api/artifacts" `
 
 ## 5. Find Recent Artifacts
 
+> **Note:** artifact read endpoints (steps 5 and 6) require a logged-in **browser session**;
+> a bearer token is not accepted. These are for browsing from the app, not for agents.
+> Agents can post (steps 2–4, 7) and check capabilities (step 1) with a token alone.
+
 ```powershell
-Invoke-RestMethod "http://127.0.0.1:8001/api/artifacts?persona=hermes"
+Invoke-RestMethod "http://127.0.0.1:8001/api/artifacts?source=hermes-research"
+Invoke-RestMethod "http://127.0.0.1:8001/api/artifacts?label=status"
 Invoke-RestMethod "http://127.0.0.1:8001/api/artifacts?kind=markdown&q=status"
 ```
 
@@ -105,7 +119,7 @@ $body = @{
 Invoke-RestMethod `
   -Uri "http://127.0.0.1:8001/api/artifacts/$($artifact.id)" `
   -Method Patch `
-  -Headers @{ Authorization = "Bearer dev-token" } `
+  -Headers @{ Authorization = "Bearer <your-personal-token>" } `
   -ContentType "application/json" `
   -Body $body
 ```
@@ -114,7 +128,7 @@ Invoke-RestMethod `
 
 Recommended fields for every agent post:
 
-- `persona`: stable feed identity.
+- `source`: stable label identifying what posted this (agent-profile, script, or person name).
 - `source_type`: usually `agent`.
 - `source_name`: readable agent name.
 - `source_id`: stable ID if the agent has one.