Add multi-user auth, settings area, and unified label feed

Turns Daybook into a multi-user tool and reworks the feed UI:

- Multi-user: Django session login (username/password + remember-me),
  per-user personal API tokens (DRF authtoken), whole app gated behind
  login. Each artifact has an owner; feeds are private per user.
- Rename persona -> source (free-text label for whatever posted an
  artifact: agent-profile, script, or person). source + tags form one
  unified label system; single label filter matches tags, source has
  its own filter/column/sidebar.
- Settings area (gear/user menu, top-right): Account (view/regenerate
  token) and Demo Data (in-app button seeding one artifact per kind).
  User account management via Django admin (superusers only).
- Feed rework: rolling 7-day window with sticky inline date separators
  and infinite scroll; left sidebar is now a Sources list with per-source
  unread counts; artifact type shown as text after title; source in its
  own column.
- Unread tracking: read_at on Artifact, marked read when previewed,
  bold titles for unread, sidebar unread badges, old banner removed.
- Tag colours: global shared registry, hash-based default with optional
  per-tag override via tag_colors on POST/PATCH.
- Ingest: token resolves owner; same source name under two users' tokens
  stays isolated. daybook_post.py renamed persona->source, requires a
  real token, --check accepts a bearer token. Docs updated to match.

Migrations 0004-0008 rename persona, add owner (nullable -> backfill to
first superuser -> required), and add read_at. Fresh installs no-op the
backfill.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

skills/daybook-posting/SKILL.md

@@ -27,11 +27,13 @@ The artifact URL is printed as the final stdout line.
 Use environment variables:
 
 ```text
-DAYBOOK_URL=http://127.0.0.1:8000
-DAYBOOK_TOKEN=dev-token
-DAYBOOK_PERSONA=agent
+DAYBOOK_URL=http://127.0.0.1:8001
+DAYBOOK_TOKEN=your-personal-api-token
+DAYBOOK_SOURCE=agent
 ```
 
+`DAYBOOK_TOKEN` is your personal per-user API token, from Settings → Account in the app (not a token shared by everyone). Artifacts posted with your token land only in your feed.
+
 ## Kind Cheat Sheet
 
 | Kind | Use for | Content shape |
@@ -48,7 +50,7 @@ For CSV, JSON, or code that should render today, use `--file path --as-markdown`
 ## Rules
 
 - Run `--check` first if unsure Daybook is reachable.
-- Use a stable `DAYBOOK_PERSONA` or pass `--persona`.
+- Use a stable `DAYBOOK_SOURCE` or pass `--source` (the agent-profile, script, or person name that produced this artifact).
 - Use `--tags a,b,c` for filtering.
 - Use `--meta run_id=... --meta model=...` for machine-readable context.
 - Never inline multiline content into the shell command; use a file or stdin.

skills/daybook-posting/scripts/daybook_post.py

@@ -20,26 +20,39 @@ from urllib.request import Request, urlopen
 
 TEXT_KINDS = {"markdown", "html_fragment", "html_full", "deck"}
 TEXT_SUFFIXES = {".md", ".markdown", ".txt", ".html", ".htm"}
-DEFAULT_URL = "http://127.0.0.1:8000"
-DEFAULT_TOKEN = "dev-token"
-DEFAULT_PERSONA = "agent"
+DEFAULT_URL = "http://127.0.0.1:8001"
+DEFAULT_SOURCE = "agent"
 
 
 def main():
     args = parse_args()
     base_url = os.environ.get("DAYBOOK_URL", DEFAULT_URL).rstrip("/")
-    token = os.environ.get("DAYBOOK_TOKEN", DEFAULT_TOKEN)
-    persona = args.persona or os.environ.get("DAYBOOK_PERSONA", DEFAULT_PERSONA)
+    # DAYBOOK_TOKEN is your personal per-user token (Settings -> Account in the app);
+    # there is no shared fallback token, so posting without it cannot work.
+    token = os.environ.get("DAYBOOK_TOKEN", "")
+    source = args.source or os.environ.get("DAYBOOK_SOURCE", DEFAULT_SOURCE)
 
     if args.check:
-        response = request_json("GET", f"{base_url}/api/capabilities")
+        try:
+            response = request_json("GET", f"{base_url}/api/capabilities", token)
+        except (HTTPError, URLError) as exc:
+            print_http_error(exc)
+            return 1
         print(json.dumps(response, indent=2))
         return 0
 
+    if not token:
+        print(
+            "error: DAYBOOK_TOKEN is not set. Get your personal API token from "
+            f"{base_url}/settings/account/ and set DAYBOOK_TOKEN.",
+            file=sys.stderr,
+        )
+        return 2
+
     try:
         if args.path:
             resolve_auto_path(args)
-        payload = build_payload(args, persona)
+        payload = build_payload(args, source)
         validate_payload(payload, args)
         if args.dry_run:
             print_dry_run(base_url, token, payload, args)
@@ -62,14 +75,14 @@ def parse_args():
     parser.add_argument("path", nargs="?", help="Auto mode: one file path. Kind, content-type, and title are inferred. The simplest way to post.")
     parser.add_argument("--kind", choices=sorted(TEXT_KINDS), help="Text artifact kind. Omit when using --file or a positional path.")
     parser.add_argument("--title", help="Artifact title. Required unless --check is used.")
-    parser.add_argument("--persona", help="Artifact persona. Defaults to DAYBOOK_PERSONA or 'agent'.")
+    parser.add_argument("--source", help="Artifact source (agent-profile, script, or person name). Defaults to DAYBOOK_SOURCE or 'agent'.")
     parser.add_argument("--content-file", help="Read text artifact content from this file.")
     parser.add_argument("--file", help="Upload this file as image/pdf/binary, or render as markdown with --as-markdown.")
     parser.add_argument("--tags", help="Comma-separated tags.")
     parser.add_argument("--theme", help="Theme for markdown/html_fragment. Example: report, tasks, bootstrap.")
     parser.add_argument("--meta", action="append", default=[], help="Metadata key=value. Repeatable.")
     parser.add_argument("--meta-json", help="Metadata JSON object. Merged with --meta values.")
-    parser.add_argument("--source-name", help="Human-readable source name. Defaults to persona.")
+    parser.add_argument("--source-name", help="Human-readable source name. Defaults to --source.")
     parser.add_argument("--source-id", default="", help="Stable source identifier.")
     parser.add_argument("--source-prompt", default="", help="Prompt/instruction that produced the artifact.")
     parser.add_argument("--source-type", choices=["agent", "person", "system"], default="agent")
@@ -160,14 +173,14 @@ def humanize(stem):
     return cleaned.title() if cleaned else stem
 
 
-def build_payload(args, persona):
+def build_payload(args, source):
     metadata = parse_metadata(args)
     common = {
-        "persona": persona,
+        "source": source,
         "title": args.title,
         "tags": normalize_tags(args.tags),
         "source_type": args.source_type,
-        "source_name": args.source_name or persona,
+        "source_name": args.source_name or source,
         "source_id": args.source_id,
         "source_prompt": args.source_prompt,
         "metadata": metadata,
@@ -357,9 +370,11 @@ def content_type_for(path):
     return mimetypes.guess_type(path.name)[0] or "application/octet-stream"
 
 
-def request_json(method, url):
+def request_json(method, url, token=""):
     request = Request(url, method=method)
     request.add_header("Accept", "application/json")
+    if token:
+        request.add_header("Authorization", f"Bearer {token}")
     with urlopen(request, timeout=15) as response:
         return json.loads(response.read().decode("utf-8"))