Add GET /api/skill endpoint serving the posting skill

Serves skills/daybook-posting/SKILL.md so users/agents can fetch the
posting instructions from the running instance instead of hunting for the
file. The server rewrites the DAYBOOK_URL config line to the request's own
origin, so the text handed to an agent already points at the right server;
the recipient only supplies their token.

- Same auth as /api/capabilities (session or bearer token); no user data.
- Raw text/markdown by default, ?format=json returns {version, url, skill}.
- Advertised via skill_url + a /api/skill methods entry in capabilities.
- Ships in the Docker image (COPY . /app, skills/ not dockerignored).
- Tests for auth, origin rewrite, JSON mode, session auth, capabilities ad.
- docs/api.md + CHANGELOG updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -6,7 +6,16 @@ the git tags (`vX.Y.Z`) and `daybook_project.__version__`.
 
 ## [Unreleased]
 
-_Nothing yet._
+### Added
+- `GET /api/skill` serves the bundled agent-posting skill as Markdown (or
+  `?format=json`), with `DAYBOOK_URL` pre-filled to the instance's own
+  origin so the instructions are ready to hand to an AI. Advertised as
+  `skill_url` in `/api/capabilities`.
+
+### Changed
+- Rewrote the posting skill (`skills/daybook-posting/SKILL.md`) to be
+  location-agnostic: no longer assumes a local source checkout, reframes
+  `DAYBOOK_URL` as set-your-instance, and adds a raw `curl` fallback.
 
 ## [0.1.0] — 2026-09-03