Add community node protocol spec, Agent Skills, and make the failing tests hermetic

Community nodes (Phase 1 of plan.md): the protocol specification in
services/nodes/spec.py as the single source of truth, GET /nodes/spec.json,
a generated protocol docs page, the Community nodes API docs group, and the
implementation plan plus the residential proxy research. The no-open-proxy rule
is enforced in the spec (open_proxy cannot be set).

Agent Skills: register the Skills API docs group, cascade skills on account
deletion, add the nested CLAUDE.md, README and routes docs, and cover the
parser, the fetcher (end to end against a mock origin), the data layer and the
routes with 73 unit and 16 api tests.

Tests made hermetic with the repo's existing patterns instead of ambient
environment: embeddings tests set OPENROUTER_API_KEY via monkeypatch, the
workspace tests install FakeBackend via runtime.set_backend, and the skills
install tests use run_async. DockerCliBackend now returns 127 (command not
found) when the CLI is missing instead of raising FileNotFoundError, so a host
without docker answers with a clean error rather than a 500. The Providers tab
empty state no longer names the Model routes tab.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/api/profile/index.py

@@ -707,4 +707,59 @@ def test_the_owner_gets_the_privacy_controls(app_server):
     assert "Only the account holder can change this." not in html
 
 
+def _profile_json_body(session, username):
+    return session.get(
+        f"{BASE_URL}/profile/{username}",
+        headers={"Accept": "application/json"},
+    ).json()
+
+
+def test_owner_sees_own_key_and_member_flag(app_server, seeded_db):
+    from devplacepy.database import get_table, refresh_snapshot
+
+    session, name = _privacy_member("keyo")
+    refresh_snapshot()
+    expected = get_table("users").find_one(username=name)["api_key"]
+    body = _profile_json_body(session, name)
+    assert body["profile_is_admin"] is False
+    assert body["viewer_is_admin"] is False
+    assert body["is_owner"] is True
+    assert body["can_view_api_key"] is True
+    assert body["api_key"] == expected
+
+
+def test_admin_sees_member_key_and_flags(app_server, seeded_db):
+    from devplacepy.database import get_table, refresh_snapshot
+
+    _, name = _privacy_member("keya")
+    refresh_snapshot()
+    expected = get_table("users").find_one(username=name)["api_key"]
+    body = _profile_json_body(_admin_session(), name)
+    assert body["profile_is_admin"] is False
+    assert body["viewer_is_admin"] is True
+    assert body["is_owner"] is False
+    assert body["can_view_api_key"] is True
+    assert body["api_key"] == expected
+
+
+def test_admin_profile_marks_admin_flag_for_guest(app_server, seeded_db):
+    body = requests.get(
+        f"{BASE_URL}/profile/alice_test",
+        headers={"Accept": "application/json"},
+    ).json()
+    assert body["profile_is_admin"] is True
+    assert body["viewer_is_admin"] is False
+    assert body["can_view_api_key"] is False
+    assert body["api_key"] is None
+
+
+def test_stranger_gets_no_key(app_server, seeded_db):
+    _, name = _privacy_member("keys")
+    stranger, _ = _privacy_member("keyv")
+    body = _profile_json_body(stranger, name)
+    assert body["profile_is_admin"] is False
+    assert body["can_view_api_key"] is False
+    assert body["api_key"] is None
+
+