Add GET /api/skill endpoint serving the posting skill

Serves skills/daybook-posting/SKILL.md so users/agents can fetch the
posting instructions from the running instance instead of hunting for the
file. The server rewrites the DAYBOOK_URL config line to the request's own
origin, so the text handed to an agent already points at the right server;
the recipient only supplies their token.

- Same auth as /api/capabilities (session or bearer token); no user data.
- Raw text/markdown by default, ?format=json returns {version, url, skill}.
- Advertised via skill_url + a /api/skill methods entry in capabilities.
- Ships in the Docker image (COPY . /app, skills/ not dockerignored).
- Tests for auth, origin rewrite, JSON mode, session auth, capabilities ad.
- docs/api.md + CHANGELOG updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/api/test_artifacts.py

@@ -12,6 +12,7 @@ from django.utils import timezone
 from rest_framework.authtoken.models import Token
 from rest_framework.test import APITestCase
 
+from daybook_project import __version__
 from artifacts.models import Artifact
 
 User = get_user_model()
@@ -78,6 +79,42 @@ class ArtifactAPITestCase(APITestCase):
         response = self.client.get(reverse("capabilities-api"))
         self.assertEqual(response.status_code, 200)
 
+    def test_capabilities_advertises_skill(self):
+        response = self.client.get(reverse("capabilities-api"), **self.auth_headers(self.token))
+        self.assertEqual(response.data["methods"]["/api/skill"], ["GET"])
+        self.assertTrue(response.data["skill_url"].endswith("/api/skill"))
+
+    # -- skill ----------------------------------------------------------
+
+    def test_skill_requires_auth(self):
+        response = self.client.get(reverse("skill-api"))
+        self.assertEqual(response.status_code, 403)
+
+    def test_skill_returns_markdown_with_origin_filled_in(self):
+        response = self.client.get(reverse("skill-api"), **self.auth_headers(self.token))
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response["Content-Type"], "text/markdown; charset=utf-8")
+        body = response.content.decode()
+        # Frontmatter is intact and the config placeholder is rewritten to this
+        # instance's origin (http://testserver under the test client).
+        self.assertIn("name: daybook-posting", body)
+        self.assertIn("DAYBOOK_URL=http://testserver", body)
+        self.assertNotIn("your-daybook-instance.example.com", body)
+
+    def test_skill_json_format(self):
+        response = self.client.get(
+            reverse("skill-api"), {"format": "json"}, **self.auth_headers(self.token)
+        )
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.data["version"], __version__)
+        self.assertEqual(response.data["url"], "http://testserver")
+        self.assertIn("name: daybook-posting", response.data["skill"])
+
+    def test_skill_with_session(self):
+        self.client.force_login(self.user)
+        response = self.client.get(reverse("skill-api"))
+        self.assertEqual(response.status_code, 200)
+
     # -- create (POST) --------------------------------------------------
 
     def test_create_markdown_artifact(self):