Add community node protocol spec, Agent Skills, and make the failing tests hermetic

Community nodes (Phase 1 of plan.md): the protocol specification in
services/nodes/spec.py as the single source of truth, GET /nodes/spec.json,
a generated protocol docs page, the Community nodes API docs group, and the
implementation plan plus the residential proxy research. The no-open-proxy rule
is enforced in the spec (open_proxy cannot be set).

Agent Skills: register the Skills API docs group, cascade skills on account
deletion, add the nested CLAUDE.md, README and routes docs, and cover the
parser, the fetcher (end to end against a mock origin), the data layer and the
routes with 73 unit and 16 api tests.

Tests made hermetic with the repo's existing patterns instead of ambient
environment: embeddings tests set OPENROUTER_API_KEY via monkeypatch, the
workspace tests install FakeBackend via runtime.set_backend, and the skills
install tests use run_async. DockerCliBackend now returns 127 (command not
found) when the CLI is missing instead of raising FileNotFoundError, so a host
without docker answers with a clean error rather than a 500. The Providers tab
empty state no longer names the Model routes tab.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/api/skills/install.py

@@ -0,0 +1,157 @@
+# retoor <retoor@molodetz.nl>
+
+import uuid
+
+import pytest
+import requests
+from starlette.testclient import TestClient
+
+import devplacepy.main as m
+from devplacepy.database import get_table
+from devplacepy.database.skills import get_skill_row
+from devplacepy.routers import skills as skills_router
+from devplacepy.services.skills import limits
+from devplacepy.services.skills.fetcher import FetchedSkill, SkillFetchError, SkippedFile
+from devplacepy.services.skills.parser import parse_skill_md
+from devplacepy.services.skills.prompt import skill_index_lines
+from tests.conftest import BASE_URL
+
+JSON = {"Accept": "application/json"}
+
+
+def _signup_install():
+    name = f"ins{uuid.uuid4().hex[:10]}"
+    requests.post(
+        f"{BASE_URL}/auth/signup",
+        data={
+            "username": name,
+            "email": f"{name}@t.dev",
+            "password": "secret123",
+            "confirm_password": "secret123",
+            "birth_date": "1990-01-01",
+            "accept_terms": "1",
+        },
+        allow_redirects=True,
+    )
+    return get_table("users").find_one(username=name)
+
+
+def _fetched(name="installed-skill", description="Installed through the route."):
+    parsed = parse_skill_md(f"---\nname: {name}\ndescription: {description}\n---\n# Body\n\n`scripts/run.py`")
+    return FetchedSkill(
+        parsed=parsed,
+        source_url=f"https://skills.example/{name}/SKILL.md",
+        files={"scripts/run.py": "print(1)"},
+        skipped=[SkippedFile("assets/logo.png", "binary or unsupported file type; only text files are stored")],
+        warnings=["a warning"],
+    )
+
+
+@pytest.fixture
+def client(app_server):
+    return TestClient(m.app)
+
+
+def _headers(user):
+    return {"X-API-KEY": user["api_key"], **JSON}
+
+
+def test_install_through_the_route_stores_audits_and_feeds_the_prompt(client, monkeypatch):
+    user = _signup_install()
+
+    async def fake_fetch(url):
+        return _fetched()
+
+    monkeypatch.setattr(skills_router, "fetch_skill", fake_fetch)
+    response = client.post("/skills/install", data={"url": "https://skills.example/x"}, headers=_headers(user))
+    assert response.status_code == 200
+    body = response.json()
+    assert body["action"] == "install"
+    skill = body["skill"]
+    assert skill["name"] == "installed-skill"
+    assert skill["files"] == {"scripts/run.py": "print(1)"}
+    assert skill["skipped"] == [
+        {"path": "assets/logo.png", "reason": "binary or unsupported file type; only text files are stored"}
+    ]
+    assert skill["warnings"] == ["a warning"]
+    assert len(skill["sha256"]) == 64
+    assert get_skill_row(user["uid"], "installed-skill")["enabled"] == 1
+    assert "installed-skill: Installed through the route." in skill_index_lines(user["uid"])
+    audit = [e for e in get_table("audit_log").find(target_uid=skill["uid"]) if e["event_key"] == "skill.install"]
+    assert len(audit) == 1 and audit[0]["result"] == "success"
+
+
+def test_reinstalling_updates_in_place_and_keeps_the_uid(client, monkeypatch):
+    user = _signup_install()
+    calls = {"description": "First."}
+
+    async def fake_fetch(url):
+        return _fetched(description=calls["description"])
+
+    monkeypatch.setattr(skills_router, "fetch_skill", fake_fetch)
+    first = client.post("/skills/install", data={"url": "https://skills.example/x"}, headers=_headers(user)).json()
+    calls["description"] = "Second."
+    second = client.post("/skills/install", data={"url": "https://skills.example/x"}, headers=_headers(user)).json()
+    assert first["action"] == "install" and second["action"] == "update"
+    assert first["skill"]["uid"] == second["skill"]["uid"]
+    assert second["skill"]["description"] == "Second."
+    listing = client.get("/skills", headers=_headers(user)).json()
+    assert listing["skill_total"] == 1
+    keys = [e["event_key"] for e in get_table("audit_log").find(target_uid=first["skill"]["uid"])]
+    assert "skill.install" in keys and "skill.update" in keys
+
+
+def test_a_failed_fetch_is_audited_as_a_failure_and_stores_nothing(client, monkeypatch):
+    user = _signup_install()
+
+    async def failing_fetch(url):
+        raise SkillFetchError("the server returned 500")
+
+    monkeypatch.setattr(skills_router, "fetch_skill", failing_fetch)
+    response = client.post("/skills/install", data={"url": "https://skills.example/x"}, headers=_headers(user))
+    assert response.status_code == 400
+    assert response.json()["error"]["message"] == "the server returned 500"
+    assert client.get("/skills", headers=_headers(user)).json()["skill_total"] == 0
+    failures = [
+        e
+        for e in get_table("audit_log").find(actor_uid=user["uid"])
+        if e["event_key"] == "skill.install" and e["result"] == "failure"
+    ]
+    assert len(failures) == 1
+
+
+def test_the_per_user_cap_refuses_a_new_install_but_allows_an_update(client, monkeypatch):
+    user = _signup_install()
+    current = {"name": "cap-0"}
+
+    async def fake_fetch(url):
+        return _fetched(name=current["name"])
+
+    monkeypatch.setattr(skills_router, "fetch_skill", fake_fetch)
+    for index in range(limits.SKILLS_PER_USER_MAX):
+        current["name"] = f"cap-{index}"
+        assert client.post("/skills/install", data={"url": "https://s.example/x"}, headers=_headers(user)).status_code == 200
+    current["name"] = "one-too-many"
+    refused = client.post("/skills/install", data={"url": "https://s.example/x"}, headers=_headers(user))
+    assert refused.status_code == 400
+    assert "at most" in refused.json()["error"]["message"]
+    current["name"] = "cap-0"
+    assert client.post("/skills/install", data={"url": "https://s.example/x"}, headers=_headers(user)).json()["action"] == "update"
+
+
+def test_a_browser_install_redirects_to_the_list(client, monkeypatch):
+    user = _signup_install()
+
+    async def fake_fetch(url):
+        return _fetched(name="browser-skill")
+
+    monkeypatch.setattr(skills_router, "fetch_skill", fake_fetch)
+    response = client.post(
+        "/skills/install",
+        data={"url": "https://skills.example/x"},
+        headers={"X-API-KEY": user["api_key"], "Accept": "text/html"},
+        follow_redirects=False,
+    )
+    assert response.status_code == 302
+    assert response.headers["location"] == "/skills"
+    assert get_skill_row(user["uid"], "browser-skill") is not None