feat(api): one API for curl and MCP, REST reads with keys, origin badge with key name

API keys reach tasks and lists over plain REST too (GET /task-lists, GET /tasks with
status/due filters, PATCH/DELETE /thoughts/{id}, GET /lists, list items), guarded by a route
table; notes and settings stay closed. Rights hold for every access alike (webhook:task also
allows create_task over MCP, tasks:write also task delivery).

Tasks, thoughts and list items record which key created them and which one changed them last
(migration 13 replaces agent_mark; origin stays after the user's own edits and survives the
triage into a list item). OriginBadge shows the key name with a webhook or robot icon, details
on hover and tap, and replaces the Webhook and KI badges everywhere, now also on list items.

Settings: category "API" with rights grouped by tasks, lists and inbox and two tabs
(curl / smart home with a Home Assistant sensor, AI agents over MCP). Docs, help, README and
changelog updated; v0.30.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/handlers_lists.go

@@ -161,14 +161,15 @@ func (s *Server) handleCreateListItem(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, err.Error())
 		return
 	}
+	s.recordListItemOrigin(item, actorFrom(r.Context()), true)
 
 	s.wsHub.BroadcastListEvent(listID, "ITEM_CREATED", item)
 	writeJSON(w, http.StatusCreated, item)
 }
 
 // setListItemDone checks an item off (or back on) and tells the list's viewers. Shared by
-// PATCH /lists/{id}/items/{itemId} and the MCP tool check_list_item (byAgent); access is checked first.
-func (s *Server) setListItemDone(userID, listID, itemID string, done, byAgent bool) (*domain.ListItem, error) {
+// PATCH /lists/{id}/items/{itemId} and the MCP tool check_list_item; access is checked first.
+func (s *Server) setListItemDone(userID, listID, itemID string, done bool, actor *apiActor) (*domain.ListItem, error) {
 	if err := s.store.EnsureListItemsWritable(userID, listID, itemID); err != nil {
 		return nil, err
 	}
@@ -181,7 +182,7 @@ func (s *Server) setListItemDone(userID, listID, itemID string, done, byAgent bo
 	if err != nil {
 		return nil, err
 	}
-	item.AgentMark = s.store.SetListItemAgentMark(itemID, byAgent)
+	s.recordListItemOrigin(item, actor, false)
 	s.wsHub.BroadcastListEvent(listID, "ITEM_TOGGLED", item)
 	return item, nil
 }
@@ -202,7 +203,7 @@ func (s *Server) handleToggleListItem(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	item, err := s.setListItemDone(userID, listID, itemID, req.IsCompleted, false)
+	item, err := s.setListItemDone(userID, listID, itemID, req.IsCompleted, actorFrom(r.Context()))
 	if err != nil {
 		writeError(w, http.StatusBadRequest, err.Error())
 		return
@@ -232,7 +233,7 @@ func (s *Server) handleUpdateListItem(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, err.Error())
 		return
 	}
-	item.AgentMark = s.store.SetListItemAgentMark(itemID, false)
+	s.recordListItemOrigin(item, actorFrom(r.Context()), false)
 
 	s.wsHub.BroadcastListEvent(listID, "ITEM_UPDATED", item)
 	writeJSON(w, http.StatusOK, item)