feat(api): one API for curl and MCP, REST reads with keys, origin badge with key name

API keys reach tasks and lists over plain REST too (GET /task-lists, GET /tasks with
status/due filters, PATCH/DELETE /thoughts/{id}, GET /lists, list items), guarded by a route
table; notes and settings stay closed. Rights hold for every access alike (webhook:task also
allows create_task over MCP, tasks:write also task delivery).

Tasks, thoughts and list items record which key created them and which one changed them last
(migration 13 replaces agent_mark; origin stays after the user's own edits and survives the
triage into a list item). OriginBadge shows the key name with a webhook or robot icon, details
on hover and tap, and replaces the Webhook and KI badges everywhere, now also on list items.

Settings: category "API" with rights grouped by tasks, lists and inbox and two tabs
(curl / smart home with a Home Assistant sensor, AI agents over MCP). Docs, help, README and
changelog updated; v0.30.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/components/__tests__/OriginBadge.test.tsx

@@ -0,0 +1,35 @@
+import { describe, it, expect } from 'vitest';
+import { render, fireEvent } from '@testing-library/react';
+import { OriginBadge, originDetails } from '../OriginBadge';
+
+describe('OriginBadge', () => {
+  it('shows nothing for entries no key touched', () => {
+    expect(render(<OriginBadge origin={undefined} />).container.firstChild).toBeNull();
+    expect(render(<OriginBadge origin={{}} />).container.firstChild).toBeNull();
+  });
+
+  it('names the key that created the entry, else the one that changed it', () => {
+    const created = render(<OriginBadge origin={{ createdVia: 'api', createdKey: 'Home Assistant', changedVia: 'mcp', changedKey: 'Claude Code' }} />);
+    expect(created.container.textContent).toBe('Home Assistant');
+    const changed = render(<OriginBadge origin={{ changedVia: 'mcp', changedKey: 'Claude Code' }} />);
+    expect(changed.container.textContent).toBe('Claude Code');
+    const old = render(<OriginBadge origin={{ createdVia: 'mcp' }} />);
+    expect(old.container.textContent).toBe('MCP');
+  });
+
+  it('opens the details on tap', () => {
+    const { getByRole, queryByRole } = render(
+      <OriginBadge origin={{ changedVia: 'mcp', changedKey: 'Claude Code', changedAt: '2026-11-01T09:40:00Z' }} createdAt="2026-10-31T08:00:00Z" />
+    );
+    expect(queryByRole('tooltip')).toBeNull();
+    fireEvent.click(getByRole('button'));
+    const tip = getByRole('tooltip').textContent || '';
+    expect(tip).toContain('In der App angelegt');
+    expect(tip).toContain('zuletzt geändert per MCP (Claude Code)');
+  });
+
+  it('describes both created and changed', () => {
+    const text = originDetails({ createdVia: 'api', createdKey: 'HA', changedVia: 'mcp', changedKey: 'Claude Code' }, '2026-11-01T08:12:00Z');
+    expect(text).toMatch(/^Angelegt per API \(HA\) am .* · zuletzt geändert per MCP \(Claude Code\)$/);
+  });
+});