Add community node protocol spec, Agent Skills, and make the failing tests hermetic

Community nodes (Phase 1 of plan.md): the protocol specification in
services/nodes/spec.py as the single source of truth, GET /nodes/spec.json,
a generated protocol docs page, the Community nodes API docs group, and the
implementation plan plus the residential proxy research. The no-open-proxy rule
is enforced in the spec (open_proxy cannot be set).

Agent Skills: register the Skills API docs group, cascade skills on account
deletion, add the nested CLAUDE.md, README and routes docs, and cover the
parser, the fetcher (end to end against a mock origin), the data layer and the
routes with 73 unit and 16 api tests.

Tests made hermetic with the repo's existing patterns instead of ambient
environment: embeddings tests set OPENROUTER_API_KEY via monkeypatch, the
workspace tests install FakeBackend via runtime.set_backend, and the skills
install tests use run_async. DockerCliBackend now returns 127 (command not
found) when the CLI is missing instead of raising FileNotFoundError, so a host
without docker answers with a clean error rather than a 500. The Providers tab
empty state no longer names the Model routes tab.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/api/nodes/__init__.py

@@ -0,0 +1 @@
+# retoor <retoor@molodetz.nl>

tests/api/nodes/spec.py

@@ -0,0 +1,39 @@
+# retoor <retoor@molodetz.nl>
+
+import requests
+
+from devplacepy.services.nodes.spec import SPEC
+from tests.conftest import BASE_URL
+
+
+def test_spec_json_is_public_and_matches_the_spec(app_server):
+    response = requests.get(f"{BASE_URL}/nodes/spec.json")
+    assert response.status_code == 200
+    assert response.headers["content-type"].startswith("application/json")
+    assert response.json() == SPEC.describe()
+
+
+def test_spec_json_never_describes_an_open_proxy(app_server):
+    body = requests.get(f"{BASE_URL}/nodes/spec.json").json()
+    assert body["open_proxy"] is False
+    assert body["allowed_ports"] == [80, 443]
+
+
+def test_protocol_docs_page_renders_every_spec_value(app_server):
+    response = requests.get(f"{BASE_URL}/docs/nodes-protocol.html")
+    assert response.status_code == 200
+    page = response.text
+    for frame in SPEC.frames:
+        assert f"<code>{frame.type}</code>" in page
+    for destination in SPEC.destinations:
+        assert destination.suffix in page
+    for refusal in SPEC.refusals:
+        assert refusal.code in page
+    for name in SPEC.limits.describe():
+        assert name in page
+
+
+def test_nodes_api_docs_group_lists_the_spec_endpoint(app_server):
+    response = requests.get(f"{BASE_URL}/docs/nodes.html")
+    assert response.status_code == 200
+    assert "/nodes/spec.json" in response.text