Add community node protocol spec, Agent Skills, and make the failing tests hermetic

Community nodes (Phase 1 of plan.md): the protocol specification in
services/nodes/spec.py as the single source of truth, GET /nodes/spec.json,
a generated protocol docs page, the Community nodes API docs group, and the
implementation plan plus the residential proxy research. The no-open-proxy rule
is enforced in the spec (open_proxy cannot be set).

Agent Skills: register the Skills API docs group, cascade skills on account
deletion, add the nested CLAUDE.md, README and routes docs, and cover the
parser, the fetcher (end to end against a mock origin), the data layer and the
routes with 73 unit and 16 api tests.

Tests made hermetic with the repo's existing patterns instead of ambient
environment: embeddings tests set OPENROUTER_API_KEY via monkeypatch, the
workspace tests install FakeBackend via runtime.set_backend, and the skills
install tests use run_async. DockerCliBackend now returns 127 (command not
found) when the CLI is missing instead of raising FileNotFoundError, so a host
without docker answers with a clean error rather than a 500. The Providers tab
empty state no longer names the Model routes tab.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Makefile

@@ -213,6 +213,36 @@ docker-clean:
 
 docker-bup: docker-build docker-up
 
+# Rootless-podman hosts have no docker daemon: the podman overlay runs the app
+# as container root (== invoking host user under rootless, see
+# docker-compose.podman.yml) so the bind-mounted checkout stays writable.
+# Always update through these targets - a bare `up` without the overlay file
+# recreates the app with the base `user: 1000:1000` and it crashes on startup
+# with PermissionError (container uid 1000 maps to a subordinate host uid).
+PCOMPOSE := podman-compose -f docker-compose.yml -f docker-compose.podman.yml
+
+.PHONY: podman-build podman-up podman-reload podman-down podman-logs podman-ps
+
+podman-build: docker-prep
+	$(PCOMPOSE) build
+
+podman-up: docker-prep
+	$(PCOMPOSE) up -d
+	@loginctl show-user "$$(id -un)" 2>/dev/null | grep -q 'Linger=yes' || echo "WARNING: user linger is off - containers will NOT restart after a reboot until someone logs in (fix: sudo loginctl enable-linger $$(id -un))"
+
+podman-reload:
+	$(PCOMPOSE) restart app
+	$(PCOMPOSE) up -d
+
+podman-down:
+	$(PCOMPOSE) down
+
+podman-logs:
+	$(PCOMPOSE) logs -f
+
+podman-ps:
+	$(PCOMPOSE) ps
+
 deploy:
 	git checkout production
 	git merge master