feat: resolve daily-note path from Obsidian config for scoped tokens

- Add daily_note_path_for_vault to read .obsidian/daily-notes.json

- Honor configured folder and date format for daily commands

- Add moment_to_strftime to translate Obsidian date tokens

- Authorize pathless daily:* commands against the resolved path

- Pick vault root from token vault, cwd, or default vault

- Normalize n8n httpRequest response to avoid circular JSON output

- Force returnFullResponse false and parse body to plain result

- Bump n8n-nodes-obsidian-cli-api to 0.2.0

- Add tests for allowed and denied scoped daily commands

tests/test_api.py

@@ -165,3 +165,41 @@ def test_token_policy_allows_allowed_path(monkeypatch):
   # "read" is not a Python flag, which is fine for this policy test.
   assert response.status_code == 200
   assert response.json()["command"] == ["python", "read", "path=Inbox/Allowed.md"]
+
+def test_path_restricted_token_allows_daily_command_from_obsidian_config(monkeypatch, tmp_path):
+  vault = tmp_path / "vault"
+  config = vault / ".obsidian"
+  config.mkdir(parents=True)
+  (config / "daily-notes.json").write_text(json.dumps({"folder": "00. Journal", "format": "YYYY-MM-DD"}))
+
+  monkeypatch.setattr("app.policy.REGISTERED_VAULTS", {"work": str(vault)})
+  monkeypatch.setattr("app.policy.DEFAULT_VAULT_NAME", "work")
+  token = use_jwt_auth(monkeypatch, {"sub": "daily", "commands": ["daily:append"], "vaults": ["work"], "paths": ["00. Journal/"]})
+
+  response = client.post(
+    "/commands",
+    headers={"Authorization": f"Bearer {token}"},
+    json={"args": ["vault=work", "daily:append", "content=ok"], "cwd": str(vault)},
+  )
+
+  assert response.status_code == 200
+  assert response.json()["command"] == ["python", "vault=work", "daily:append", "content=ok"]
+
+def test_path_restricted_token_denies_daily_command_outside_obsidian_config(monkeypatch, tmp_path):
+  vault = tmp_path / "vault"
+  config = vault / ".obsidian"
+  config.mkdir(parents=True)
+  (config / "daily-notes.json").write_text(json.dumps({"folder": "Journal", "format": "YYYY-MM-DD"}))
+
+  monkeypatch.setattr("app.policy.REGISTERED_VAULTS", {"work": str(vault)})
+  monkeypatch.setattr("app.policy.DEFAULT_VAULT_NAME", "work")
+  token = use_jwt_auth(monkeypatch, {"sub": "daily", "commands": ["daily:append"], "vaults": ["work"], "paths": ["00. Journal/"]})
+
+  response = client.post(
+    "/commands",
+    headers={"Authorization": f"Bearer {token}"},
+    json={"args": ["vault=work", "daily:append", "content=ok"], "cwd": str(vault)},
+  )
+
+  assert response.status_code == 403
+  assert response.json()["detail"].startswith("token is not allowed to access path: Journal/")