feat(api): one API for curl and MCP, REST reads with keys, origin badge with key name

API keys reach tasks and lists over plain REST too (GET /task-lists, GET /tasks with
status/due filters, PATCH/DELETE /thoughts/{id}, GET /lists, list items), guarded by a route
table; notes and settings stay closed. Rights hold for every access alike (webhook:task also
allows create_task over MCP, tasks:write also task delivery).

Tasks, thoughts and list items record which key created them and which one changed them last
(migration 13 replaces agent_mark; origin stays after the user's own edits and survives the
triage into a list item). OriginBadge shows the key name with a webhook or robot icon, details
on hover and tap, and replaces the Webhook and KI badges everywhere, now also on list items.

Settings: category "API" with rights grouped by tasks, lists and inbox and two tabs
(curl / smart home with a Home Assistant sensor, AI agents over MCP). Docs, help, README and
changelog updated; v0.30.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/storage/migrations.go

@@ -33,6 +33,7 @@ var migrations = []migration{
 	{10, "Registrierung und Einladungslinks", (*Store).migrateRegistration},
 	{11, "E-Mail-Bestätigung", (*Store).migrateEmailVerification},
 	{12, "Markierung für Einträge von KI-Agenten", (*Store).migrateAgentMark},
+	{13, "Herkunft von Einträgen (API-Schlüssel)", (*Store).migrateOrigin},
 }
 
 func (s *Store) migrate() error {