feat(api): one API for curl and MCP, REST reads with keys, origin badge with key name

API keys reach tasks and lists over plain REST too (GET /task-lists, GET /tasks with
status/due filters, PATCH/DELETE /thoughts/{id}, GET /lists, list items), guarded by a route
table; notes and settings stay closed. Rights hold for every access alike (webhook:task also
allows create_task over MCP, tasks:write also task delivery).

Tasks, thoughts and list items record which key created them and which one changed them last
(migration 13 replaces agent_mark; origin stays after the user's own edits and survives the
triage into a list item). OriginBadge shows the key name with a webhook or robot icon, details
on hover and tap, and replaces the Webhook and KI badges everywhere, now also on list items.

Settings: category "API" with rights grouped by tasks, lists and inbox and two tabs
(curl / smart home with a Home Assistant sensor, AI agents over MCP). Docs, help, README and
changelog updated; v0.30.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/lib/types.ts

@@ -148,8 +148,15 @@ export const RECURRENCE_LABELS: Record<Exclude<Recurrence, ''>, string> = {
   yearly: 'jährlich',
 };
 
-// Set while the last change came from an AI agent via MCP and the user has not touched the entry since
-export type AgentMark = 'created' | 'edited';
+// Which API key created an entry and which one changed it last, over which access (REST "api" or
+// "mcp"). Stays for good; key names come resolved from the server.
+export interface Origin {
+  createdVia?: 'api' | 'mcp';
+  createdKey?: string;
+  changedVia?: 'api' | 'mcp';
+  changedKey?: string;
+  changedAt?: string;
+}
 
 export interface Thought {
   id: string;
@@ -176,7 +183,7 @@ export interface Thought {
   sortOrder?: number;
   createdAt: string;
   triagedAt?: string;
-  agentMark?: AgentMark;
+  origin?: Origin;
 }
 
 export interface KanbanColumn {
@@ -542,7 +549,7 @@ export interface ListItem {
   sortOrder: number;
   createdAt: string;
   completedAt?: string;
-  agentMark?: AgentMark;
+  origin?: Origin;
 }
 
 export interface ListShare {