Add community node protocol spec, Agent Skills, and make the failing tests hermetic

Community nodes (Phase 1 of plan.md): the protocol specification in
services/nodes/spec.py as the single source of truth, GET /nodes/spec.json,
a generated protocol docs page, the Community nodes API docs group, and the
implementation plan plus the residential proxy research. The no-open-proxy rule
is enforced in the spec (open_proxy cannot be set).

Agent Skills: register the Skills API docs group, cascade skills on account
deletion, add the nested CLAUDE.md, README and routes docs, and cover the
parser, the fetcher (end to end against a mock origin), the data layer and the
routes with 73 unit and 16 api tests.

Tests made hermetic with the repo's existing patterns instead of ambient
environment: embeddings tests set OPENROUTER_API_KEY via monkeypatch, the
workspace tests install FakeBackend via runtime.set_backend, and the skills
install tests use run_async. DockerCliBackend now returns 127 (command not
found) when the CLI is missing instead of raising FileNotFoundError, so a host
without docker answers with a clean error rather than a 500. The Providers tab
empty state no longer names the Model routes tab.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/api/auth/login.py

@@ -225,3 +225,50 @@ def test_an_explicitly_disabled_account_still_cannot_log_in(seeded_db):
         allow_redirects=False,
     )
     assert response.status_code == 401
+
+
+def test_login_json_returns_api_key_and_member_flag(seeded_db):
+    _, name = _member()
+    row = _db_user(name)
+    response = requests.post(
+        f"{BASE_URL}/auth/login",
+        headers=JSON_audit_log,
+        data={"email": f"{name}@t.dev", "password": "secret123"},
+        allow_redirects=False,
+    )
+    assert response.status_code == 200, response.text[:300]
+    body = response.json()
+    assert body["ok"] is True
+    assert body["data"]["username"] == name
+    assert body["data"]["email"] == f"{name}@t.dev"
+    assert body["data"]["api_key"] == row["api_key"]
+    assert body["data"]["is_admin"] is False
+
+
+def test_login_json_returns_api_key_and_admin_flag(seeded_db):
+    response = requests.post(
+        f"{BASE_URL}/auth/login",
+        headers=JSON_audit_log,
+        data={
+            "email": seeded_db["alice"]["email"],
+            "password": seeded_db["alice"]["password"],
+        },
+        allow_redirects=False,
+    )
+    assert response.status_code == 200, response.text[:300]
+    body = response.json()
+    assert body["data"]["username"] == "alice_test"
+    assert body["data"]["email"] == seeded_db["alice"]["email"]
+    assert body["data"]["api_key"] == _db_user("alice_test")["api_key"]
+    assert body["data"]["is_admin"] is True
+
+
+def test_login_failure_json_leaks_no_key(app_server):
+    response = requests.post(
+        f"{BASE_URL}/auth/login",
+        headers=JSON_audit_log,
+        data={"email": f"{_unique('aunokey')}@t.dev", "password": "wrongpassword"},
+        allow_redirects=False,
+    )
+    assert response.status_code == 401
+    assert "api_key" not in response.text

tests/api/auth/signup.py

@@ -36,3 +36,41 @@ def test_signup_short_username_rerenders_with_message(app_server):
     )
     assert r.status_code == 400
     assert "Username must be between 3 and 32 characters" in r.text
+
+
+def test_signup_json_returns_api_key_and_admin_flag(seeded_db):
+    from devplacepy.database import get_table, refresh_snapshot
+
+    name = f"sgk{int(time.time() * 1000000)}"
+    r = requests.post(
+        f"{BASE_URL}/auth/signup",
+        headers={"Accept": "application/json"},
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
+        },
+        allow_redirects=False,
+    )
+    assert r.status_code == 200, r.text[:300]
+    body = r.json()
+    assert body["ok"] is True
+    assert body["data"]["username"] == name
+    assert body["data"]["email"] == f"{name}@t.dev"
+    assert body["data"]["is_admin"] is False
+    refresh_snapshot()
+    row = get_table("users").find_one(username=name)
+    assert row is not None
+    assert body["data"]["api_key"] == row["api_key"]
+    me = requests.get(
+        f"{BASE_URL}/profile",
+        headers={
+            "Accept": "application/json",
+            "X-API-KEY": body["data"]["api_key"],
+        },
+    )
+    assert me.status_code == 200
+    assert me.json()["profile_user"]["username"] == name