Document #009's substring-check limitation; fix #011's CDN docs and theme typo

#009: html_fragment's content-shape check is substring-based, so it can
false-positive on inert text inside <script>/<pre> (e.g. a JS string
literal that happens to contain "<html>"). Documented as a known
limitation in docs/api.md rather than implementing real HTML parsing - a
proper fix is a much bigger change than the narrow trigger justifies, and
substring matching is the same approach the client helper already uses.

#011: added a curated CDN Snippets section to SKILL.md for html_full
(Tailwind, Chart.js, with an offline/air-gapped caveat), scoped explicitly
to that kind only. Fixed daybook_post.py's --theme help text, which named
a non-existent "bootstrap" theme (written ahead of a vendored-Bootstrap
feature that was planned but never built, not a typo).

Also updated SKILL.md's kind cheat sheet, which never mentioned the
json/csv kinds and still pointed at the old --as-markdown workaround for
them - and filed issue #012 for a real gap that surfaced doing so: the
posting script itself doesn't support --kind json/csv yet, only the raw API
does.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

issues/012-posting-script-missing-json-csv-support.md

@@ -0,0 +1,46 @@
+# 012 — `daybook_post.py` doesn't know about the `json`/`csv` kinds
+
+**Status:** Open
+
+## Description
+
+Found while updating `SKILL.md`'s kind cheat sheet for issue #011.
+`artifacts/views.py` added first-class `json` and `csv` kinds, but the
+posting helper script wasn't updated alongside it:
+
+- `skills/daybook-posting/scripts/daybook_post.py`'s `TEXT_KINDS = {"markdown",
+  "html_fragment", "html_full", "deck"}` doesn't include `json`/`csv`, so
+  `--kind json` is rejected by argparse before a request is ever sent.
+- `TEXT_SUFFIXES` (used by positional auto-mode to sniff a file's kind from
+  its extension) doesn't include `.json`/`.csv` either — posting
+  `data.json` via the simple `daybook_post.py data.json` auto-mode path
+  uploads it as a generic downloadable `binary` artifact instead of using
+  the new interactive kind.
+- `validate_payload()` has no shape-check branch for `json` (mirroring the
+  server's `json.loads` validation, per how every other kind's client-side
+  check mirrors its server-side one).
+
+Net effect: the API itself supports `json`/`csv` fully (confirmed working
+via direct HTTP), but an agent following the documented, recommended
+workflow ("always use the helper script") currently cannot reach either
+kind at all.
+
+## Suggested Fix
+
+- Add `"json"`, `"csv"` to `TEXT_KINDS`.
+- Add `.json`/`.csv` to `TEXT_SUFFIXES` with matching `sniff_text_kind`
+  logic (or a clear rule — e.g. `.csv` always maps to `kind=csv`; `.json`
+  maps to `kind=json` unless some other signal suggests it's meant as
+  metadata).
+- Add a `json` branch to `validate_payload()`: attempt to parse and raise a
+  clear `ValueError` on invalid JSON, mirroring the server.
+- Add a usage example to `SKILL.md`/`docs/llm_posting_helper.md` for both
+  kinds (e.g. `daybook_post.py --kind json --content-file data.json`).
+- No test suite currently exists for this script at all (it's exercised
+  manually / via the API tests on the server side only) — worth deciding
+  whether this is finally worth a small script-level test file, or whether
+  server-side coverage is considered sufficient.
+
+## Resolution
+
+_(pending)_