Vikunja tooling for agent harnesses

Standard-library Python only, so any device can run it without a virtualenv:

  vk               CLI  -- for harnesses that can shell out
  vikunja_mcp.py   MCP server (stdio) -- for harnesses that speak MCP
  vkclient.py      shared client
  vk-watch@.service  systemd template for the per-device task watcher

AGENT-ONBOARDING.md is a prompt you can hand to an agent so it configures its
own access and verifies it.

vk-watch@.service

@@ -0,0 +1,21 @@
+[Unit]
+# Per-bot task watcher. Instance name is the bot's profile, e.g.
+#   systemctl --user enable --now vk-watch@bot-nullclaw
+Description=Vikunja task watcher for %i
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+# Holds VIKUNJA_PROFILE and VK_WATCH_ARGS. See README.md.
+EnvironmentFile=%h/.config/vikunja-agents/watch-%i.env
+# sh -c so VK_WATCH_ARGS splits into argv; the {task_id} placeholders are
+# brace-literals to the shell and pass through untouched.
+ExecStart=/bin/sh -c 'exec %h/.local/bin/vk watch --profile %i $VK_WATCH_ARGS'
+Restart=always
+RestartSec=30
+# The watcher only ever needs outbound HTTPS and whatever the harness needs.
+NoNewPrivileges=true
+
+[Install]
+WantedBy=default.target