add dolibarr api skills for read-only inspection

First two of an expected family of dolibarr-* skills:

- dolibarr/: platform reference — DOLAPIKEY auth, the voir_tous ACL
  trap, endpoint catalogue, the dol-curl.sh wrapper, .env credentials
  layout (gitignored, mode 600). Every future workflow skill depends
  on this one.
- dolibarr-invoice-audit/: first workflow — list KissMetrics invoices,
  audit one invoice end-to-end (JSON facts + PDF mandatory-mention
  checklist against the French legal corpus), audit the KissMetrics
  thirdparty record.

Live captures in examples/ include real audit findings to surface
to the Arcodange × KissMetrics cohort review: PDFs are missing
capital social, L.441-10 penalties, 40 € indemnity, L.123-22 / R.123-237;
KissMetrics thirdparty has no EIN (idprof1..6 all empty);
static/config/company.json holds placeholder values and a wrong
forme juridique (claims SAS, the real Dolibarr is SARL).

.gitignore hardened with *.credentials, secrets/, *.key, and an
explicit .claude/skills/**/.env pattern.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.claude/skills/dolibarr-invoice-audit/scripts/list-km-invoices.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# List Arcodange → KissMetrics invoices with payment state.
+#
+# Usage:
+#   list-km-invoices.sh [--since YYYY-MM-DD]
+#
+# KissMetrics is the thirdparty with socid=1 in this Dolibarr. If that ever
+# changes, update KM_SOCID below or detect it dynamically.
+#
+# Credit notes (AVOIRs) are flagged: ref starting with "AVC" or negative HT.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+DOL_CURL="${SCRIPT_DIR}/../../dolibarr/scripts/dol-curl.sh"
+
+KM_SOCID=1
+SINCE=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --since) SINCE="$2"; shift 2 ;;
+    -h|--help)
+      sed -n '2,12p' "$0" | sed 's/^# \{0,1\}//'
+      exit 0
+      ;;
+    *) echo "list-km-invoices.sh: unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+
+SINCE_EPOCH=0
+if [[ -n "${SINCE}" ]]; then
+  if SINCE_EPOCH=$(date -j -f "%Y-%m-%d" "${SINCE}" "+%s" 2>/dev/null); then :
+  else SINCE_EPOCH=$(date -d "${SINCE}" "+%s"); fi
+fi
+
+TMP_JSON="$(mktemp -t dollist.XXXXXX.json)"
+trap 'rm -f "${TMP_JSON}"' EXIT
+
+"${DOL_CURL}" '/invoices?limit=100&sortfield=t.datef&sortorder=DESC' > "${TMP_JSON}"
+
+python3 - "${TMP_JSON}" "${KM_SOCID}" "${SINCE_EPOCH}" <<'PY'
+import json, sys, datetime
+with open(sys.argv[1]) as f:
+    rows = json.load(f)
+km_socid  = sys.argv[2]
+since_ts  = int(sys.argv[3])
+
+km = [r for r in rows if str(r.get("socid")) == km_socid]
+km.sort(key=lambda r: int(r.get("date") or 0), reverse=True)
+
+print(f"{'id':>4}  {'ref':<24} {'date':<10}  {'HT':>10}  {'TVA':>8}  {'TTC':>10}  {'paid':<5} {'AVC':<5} pdf")
+print("-" * 112)
+total_ht = total_ttc = 0.0
+shown = 0
+for r in km:
+    ts = int(r.get("date") or 0)
+    if since_ts and ts < since_ts:
+        continue
+    shown += 1
+    dt   = datetime.datetime.fromtimestamp(ts).strftime("%Y-%m-%d") if ts else "-"
+    ht   = float(r.get("total_ht")  or 0)
+    tva  = float(r.get("total_tva") or 0)
+    ttc  = float(r.get("total_ttc") or 0)
+    paid = "yes" if str(r.get("paye")) == "1" else "no"
+    avc  = "AVOIR" if (r.get("ref","").startswith("AVC") or ht < 0) else ""
+    pdf  = r.get("last_main_doc") or "-"
+    print(f"{r['id']:>4}  {r['ref']:<24} {dt:<10}  {ht:>10.2f}  {tva:>8.2f}  {ttc:>10.2f}  {paid:<5} {avc:<5} {pdf}")
+    total_ht  += ht
+    total_ttc += ttc
+print("-" * 112)
+print(f"{'TOTAL':>40}  {total_ht:>10.2f}  {' ':>8}  {total_ttc:>10.2f}")
+print(f"# {shown} invoice(s) shown, socid={km_socid}")
+PY