feat(api): installable accounted-api agent skill + openapi-to-skill generator (#1516)

* feat(api): installable accounted-api agent skill + openapi-to-skill generator

Three layers, per the July/August 2026 agent-skills ecosystem (skills.sh /
npx skills add, as used by Stripe/Cloudflare/Supabase for their APIs):

- skills/openapi-to-skill/: generic, installable skill that turns any
  OpenAPI spec into a consumer-side integration skill, with a portable
  stdlib-only inventory/condenser tool and an output template + quality
  checklist encoding the distill-not-restate methodology.
- skills/accounted-api/: the installable skill for our own API, rendered
  deterministically by scripts/api-skill/generate.ts from the v1 endpoint
  registry + hand-authored overlays (auth, conventions, domain gotchas).
  CI gate: npm run apiskill:check (core-build.yml).
- lib/api/v1/registry.ts: generateOpenApiSpec now emits requestBody (incl.
  multipart binary parts) and path parameters, and the Zod converter learned
  .default()/z.record()/.pipe()/.transform(), so the public spec carries
  request contracts instead of prose-only.

Docs: /docs/api landing + /llms.txt now point agents at the skill install;
corrected the stale test-key description in the landing (test keys read
real data and force dry-run writes; they are not sandbox-company bound).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(skills): escape backslashes in markdown table cells (CodeQL js/incomplete-sanitization)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

scripts/api-skill/overlays/verification.md

@@ -0,0 +1,18 @@
+## Verification
+
+This skill is generated (`npm run apiskill:generate` in the Accounted repo)
+from the same endpoint registry that serves the live API, its OpenAPI spec
+(`https://app.gnubok.se/api/v1/openapi.json`), and its runtime request
+validators, so schema drift between this text and the server cannot occur for
+a matching `api_version`. CI regenerates and diffs it on every change.
+
+Before first use in a new environment, smoke-test:
+
+```bash
+curl -s https://app.gnubok.se/api/v1/health
+curl -s https://app.gnubok.se/api/v1/companies -H "Authorization: Bearer $ACCOUNTED_API_KEY"
+```
+
+If `meta.api_version` in responses is newer than the version in this skill's
+index header, refetch the skill (or read the changelog at
+https://app.gnubok.se/docs/api/changelog) before relying on endpoint details.