Review docs/api.md and docs/llm_posting_helper.md for accuracy and completeness

Same pass as the SKILL.md review. Fixed factually-wrong content and filled
gaps against the current code.

docs/api.md:
- Capabilities example response was stale: artifact_kinds missing json/csv,
  raw_supported_for missing json/csv. Corrected to match live output, with
  a note that the endpoint is the authoritative source.
- "Office document conversion is not implemented" is now false - replaced
  with the accurate scope (.xlsx -> csv only; .docx/.pptx/.xls not).
- Source Fields overview table omitted source_prompt entirely; added it,
  plus a note that source_name/source_id/source_prompt must be strings
  (400, not coerced) and metadata must be an object.
- Kinds table: noted tables now render styled in markdown/html_fragment,
  and made explicit that html_full is served verbatim with no styling.
- MVP constraints: noted the public-share-link exception to "feeds private
  per user" and clarified PATCH edits metadata only.

docs/llm_posting_helper.md:
- Added .xlsx upload, --upload-image image embedding, a Source & Theme
  Flags table (all six source-*/theme flags were undocumented here), and a
  note that --meta/--meta-json merge and are distinct from tags.
- Added a scope note that the helper only creates - update/delete need the
  API, sharing is feed-UI-only.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/api.md

@@ -28,9 +28,9 @@ Currently supported kinds:
 
 | Kind | Upload type | Rendered behavior | Raw support |
 |---|---|---|---|
-| `html_fragment` | JSON text | Wrapped with a Daybook theme | No |
-| `html_full` | JSON text | Stored as complete HTML | Yes |
-| `markdown` | JSON text | Rendered to HTML (fenced code blocks get syntax highlighting) and original `.md` is preserved | Yes |
+| `html_fragment` | JSON text | Wrapped with a Daybook theme; tables styled automatically | No |
+| `html_full` | JSON text | Stored as complete HTML, verbatim — no theme or styling injected | Yes |
+| `markdown` | JSON text | Rendered to HTML (code blocks syntax-highlighted, tables styled) and original `.md` preserved | Yes |
 | `deck` | JSON text | Wrapped as a simple HTML slide/deck page | No |
 | `image` | Multipart file | Browser image preview | No |
 | `pdf` | Multipart file | Browser PDF preview | No |
@@ -57,8 +57,13 @@ as coloured chips next to the title. The API exposes both separately, plus a com
 | `source_type` | No | `agent` | One of `agent`, `person`, `system`. |
 | `source_name` | No | `source` | Human-readable source name. |
 | `source_id` | No | Empty string | Stable external agent/person/system ID. |
+| `source_prompt` | No | Empty string | The prompt/instruction that produced the artifact. |
 | `metadata` | No | `{}` | Free-form object for model/run/tool metadata. |
 
+`source_name`, `source_id`, and `source_prompt` must be strings if provided
+— sending an object, array, or number returns `400` (they are not coerced).
+`metadata` must be an object. See "Create Text Artifact" for length limits.
+
 Example source metadata:
 
 ```json
@@ -498,10 +503,10 @@ Example response:
 
 ```json
 {
-  "artifact_kinds": ["html_fragment", "html_full", "markdown", "deck", "image", "pdf", "binary"],
+  "artifact_kinds": ["html_fragment", "html_full", "markdown", "deck", "image", "pdf", "binary", "json", "csv"],
   "filters": ["source", "label", "day", "kind", "q"],
   "views": ["rendered", "raw"],
-  "raw_supported_for": ["markdown", "html_full"],
+  "raw_supported_for": ["markdown", "html_full", "json", "csv"],
   "source_types": ["agent", "person", "system"],
   "auth": "bearer_token",
   "methods": {
@@ -512,6 +517,9 @@ Example response:
 }
 ```
 
+This is generated from the server's actual configuration, so it's the
+authoritative source if this document and a running instance ever disagree.
+
 Agents should call this endpoint if they need to adapt to the current Daybook instance, or
 simply to check the instance is reachable and their token is valid. Unlike the other read
 endpoints, it accepts a bearer token as well as a browser session:
@@ -523,8 +531,11 @@ curl -H "Authorization: Bearer <your-personal-token>" http://127.0.0.1:8001/api/
 ## Current MVP Constraints
 
 - Each user has a personal ingest API token; there is no shared token.
-- Reader/browser access requires login; feeds are private per user.
-- Content modification/revisions are deferred.
-- Office document conversion is not implemented.
+- Reader/browser access requires login; feeds are private per user (except
+  per-artifact public share links — see Sharing above).
+- Content modification/revisions are deferred (`PATCH` edits metadata only,
+  never `content`).
+- Spreadsheet conversion covers `.xlsx` → `csv` only; other Office formats
+  (`.docx`, `.pptx`, legacy `.xls`) are not converted.
 - Manual browser upload/drag-and-drop is deferred.
 - Pagination/cursors are not implemented yet.