feat(api): one API for curl and MCP, REST reads with keys, origin badge with key name

API keys reach tasks and lists over plain REST too (GET /task-lists, GET /tasks with
status/due filters, PATCH/DELETE /thoughts/{id}, GET /lists, list items), guarded by a route
table; notes and settings stay closed. Rights hold for every access alike (webhook:task also
allows create_task over MCP, tasks:write also task delivery).

Tasks, thoughts and list items record which key created them and which one changed them last
(migration 13 replaces agent_mark; origin stays after the user's own edits and survives the
triage into a list item). OriginBadge shows the key name with a webhook or robot icon, details
on hover and tap, and replaces the Webhook and KI badges everywhere, now also on list items.

Settings: category "API" with rights grouped by tasks, lists and inbox and two tabs
(curl / smart home with a Home Assistant sensor, AI agents over MCP). Docs, help, README and
changelog updated; v0.30.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/features/triage/TasksView.tsx

@@ -25,7 +25,6 @@ import {
   Settings,
   Folder,
   Filter,
-  Webhook,
   Repeat,
 } from 'lucide-react';
 import { TaskList, Thought, SubTask, Team, User, TaskListMember, KanbanColumn, PriorityLevel, Recurrence, RECURRENCE_LABELS } from '../../lib/types';
@@ -35,7 +34,7 @@ import { useKanbanTouchDrag } from './useKanbanTouchDrag';
 import { api, triggerHaptic } from '../../lib/api';
 import { UnifiedShareModal } from '../../components/UnifiedShareModal';
 import { TaskDetailModal } from './TaskDetailModal';
-import { AgentBadge } from '../../components/AgentBadge';
+import { OriginBadge } from '../../components/OriginBadge';
 import { ManageColumnsModal, DEFAULT_KANBAN_COLUMNS, columnDotClass } from './ManageColumnsModal';
 import { AvatarStack, AvatarPerson } from '../../components/AvatarStack';
 import { CountBadge } from '../../components/CountBadge';
@@ -1362,16 +1361,7 @@ export const TasksView: React.FC<TasksViewProps> = ({
                 </button>
               )}
 
-              {task.source?.toLowerCase() === 'webhook' && (
-                <span
-                  className="px-1.5 py-0.5 border border-border bg-canvas text-muted rounded-btn text-[10px] font-medium flex items-center gap-1 flex-shrink-0"
-                  title="Erstellt über Webhook"
-                >
-                  <Webhook className="w-2.5 h-2.5 text-accent" />
-                  <span>Webhook</span>
-                </span>
-              )}
-              <AgentBadge mark={task.agentMark} />
+              <OriginBadge origin={task.origin} createdAt={task.createdAt} />
 
               {/* Note indicator */}
               {task.notes && (
@@ -2436,16 +2426,7 @@ export const TasksView: React.FC<TasksViewProps> = ({
                               ⚠️ Wichtig
                             </button>
                           )}
-                          {task.source?.toLowerCase() === 'webhook' && (
-                            <span
-                              className="px-1.5 py-0.2 border border-border bg-canvas text-muted rounded-btn text-[9px] font-medium flex items-center gap-1"
-                              title="Erstellt über Webhook"
-                            >
-                              <Webhook className="w-2.5 h-2.5 text-accent" />
-                              <span>Webhook</span>
-                            </span>
-                          )}
-                          <AgentBadge mark={task.agentMark} size="xs" />
+                          <OriginBadge origin={task.origin} createdAt={task.createdAt} size="xs" />
                           {task.dueDate && (
                             <span
                               className={`inline-flex items-center gap-0.5 text-[9px] ${!task.isCompleted && isOverdue(task.dueDate) ? 'text-status-err font-semibold' : 'text-muted'}`}