Merge skills: replace skill.md with openbotauth.md

[hammadtq]

Summary

• Copies clawauth SKILL.md to /skills/openbotauth.md with full rebrand
• Updates JWKS endpoint from /agent-jwks/{id} to /jwks/{username}.json
• Adds /auth/session fetch to get username after agent registration
• Deletes old skill.md (replaced entirely by HTTP signing skill)
• Updates robots.txt skill URL

Key Changes

Rebranding

• clawauth → openbotauth throughout
• Proxy file: /tmp/openbotauth-proxy.mjs
• CA cert CN: OpenBotAuth Proxy CA

JWKS Endpoint Fix

The old /agent-jwks/{id} endpoint is deprecated (returns 410). Registration now:

1. Creates agent via POST /agents
2. Fetches /auth/session to get username
3. Builds JWKS URL as /jwks/{username}.json

Test Plan

• Build portal: pnpm build
• Deploy and verify curl https://openbotauth.org/skill/openbotauth.md returns the skill
• Test registration flow outputs correct JWKS URL
• Verify no "clawauth" references remain

[runnerelectrode]

The skill signs requests but never reports activity back to OBA. The agent profile dashboard reads from POST /agent-activity, but nothing calls it — so "Recent Activity" stays empty.

The proxy should call POST /agent-activity after each forwarded request with the method, target URL, status code, and response time. That would populate the agent dashboard.

[runnerelectrode]

The current POST /agent-activity schema is HTTP-only:

{
  "agent_id": "uuid",
  "target_url": "https://...",
  "method": "GET",
  "status_code": 200,
  "response_time_ms": 150
}

But agents operate across Discord, Telegram, Slack, Claude co-work, GitHub, etc. — not just HTTP. A generic activity schema would cover all channels:

{
  "agent_id": "uuid",
  "channel": "discord",
  "action": "message.send",
  "target": "channel:123456789",
  "metadata": {
    "guild_id": "...",
    "message_length": 240
  },
  "timestamp": "2026-02-15T12:00:00Z"
}

• channel — http, discord, telegram, claude-cowork, slack, github
• action — channel-specific action type (http.request, discord.message.send, github.pr.comment)
• target — where the action was directed (URL, channel ID, repo, etc.)
• metadata — channel-specific details (status code for HTTP, guild ID for Discord, etc.)