Add GET /api/skill endpoint serving the posting skill

Serves skills/daybook-posting/SKILL.md so users/agents can fetch the
posting instructions from the running instance instead of hunting for the
file. The server rewrites the DAYBOOK_URL config line to the request's own
origin, so the text handed to an agent already points at the right server;
the recipient only supplies their token.

- Same auth as /api/capabilities (session or bearer token); no user data.
- Raw text/markdown by default, ?format=json returns {version, url, skill}.
- Advertised via skill_url + a /api/skill methods entry in capabilities.
- Ships in the Docker image (COPY . /app, skills/ not dockerignored).
- Tests for auth, origin rewrite, JSON mode, session auth, capabilities ad.
- docs/api.md + CHANGELOG updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/api.md

@@ -529,8 +529,11 @@ Example response:
   "methods": {
     "/api/artifacts": ["GET", "POST"],
     "/api/artifacts/{id}": ["GET", "PATCH", "DELETE"],
-    "/api/assets": ["POST"]
-  }
+    "/api/assets": ["POST"],
+    "/api/capabilities": ["GET"],
+    "/api/skill": ["GET"]
+  },
+  "skill_url": "http://127.0.0.1:8001/api/skill"
 }
 ```
 
@@ -545,6 +548,33 @@ endpoints, it accepts a bearer token as well as a browser session:
 curl -H "Authorization: Bearer <your-personal-token>" http://127.0.0.1:8001/api/capabilities
 ```
 
+## Posting Skill
+
+Endpoint:
+
+```http
+GET /api/skill
+GET /api/skill?format=json
+```
+
+Returns the bundled agent-posting skill (`skills/daybook-posting/SKILL.md`) —
+the same instructions you'd give an AI so it knows how to publish to this
+instance. The server rewrites the `DAYBOOK_URL` line to **this instance's own
+origin**, so the text a caller receives already points at the right server;
+a recipient only has to fill in their `DAYBOOK_TOKEN`.
+
+Same auth as capabilities (a browser session **or** a bearer token), so a
+logged-in user can copy it to hand to their agent, or an agent can fetch it
+directly. The default response is raw Markdown (`text/markdown`); add
+`?format=json` for `{"version", "url", "skill"}`.
+
+```bash
+# Fetch the ready-to-use instructions for this instance
+curl -H "Authorization: Bearer <your-personal-token>" http://127.0.0.1:8001/api/skill
+```
+
+Discover it programmatically via `skill_url` in the capabilities response.
+
 ## Current MVP Constraints
 
 - Each user has a personal ingest API token; there is no shared token.