Add community node protocol spec, Agent Skills, and make the failing tests hermetic

Community nodes (Phase 1 of plan.md): the protocol specification in
services/nodes/spec.py as the single source of truth, GET /nodes/spec.json,
a generated protocol docs page, the Community nodes API docs group, and the
implementation plan plus the residential proxy research. The no-open-proxy rule
is enforced in the spec (open_proxy cannot be set).

Agent Skills: register the Skills API docs group, cascade skills on account
deletion, add the nested CLAUDE.md, README and routes docs, and cover the
parser, the fetcher (end to end against a mock origin), the data layer and the
routes with 73 unit and 16 api tests.

Tests made hermetic with the repo's existing patterns instead of ambient
environment: embeddings tests set OPENROUTER_API_KEY via monkeypatch, the
workspace tests install FakeBackend via runtime.set_backend, and the skills
install tests use run_async. DockerCliBackend now returns 127 (command not
found) when the CLI is missing instead of raising FileNotFoundError, so a host
without docker answers with a clean error rather than a 500. The Providers tab
empty state no longer names the Model routes tab.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docker-compose.podman.yml

@@ -0,0 +1,25 @@
+# Rootless-podman overlay for this host (no docker daemon here).
+#
+# The base file runs the app as `user: 1000:1000`. Under rootless podman the
+# default userns maps container uid 1000 to a subordinate host uid (100999),
+# which cannot write the bind-mounted checkout (owned by host uid 1000), so
+# uvicorn crashes on startup with PermissionError and nginx never starts.
+# Running as container root maps back to the invoking host user (retoor),
+# restoring write access. This stays unprivileged on the host because the
+# container is rootless.
+#
+# (A `userns_mode: keep-id` service override was tried first, but podman
+# rejects `--userns` together with `--pod`, and podman-compose places all
+# services in one pod.)
+#
+# Kept as an overlay (not inlined) so rootful `docker compose` keeps using
+# the non-root app user from the base file.
+#
+# Usage (prefer the make targets - a bare `up` without this file recreates a
+# crashing app, see PODMAN.md):
+#   make podman-up
+#   podman-compose -f docker-compose.yml -f docker-compose.podman.yml up -d
+
+services:
+  app:
+    user: "0:0"