docs(diigo-dump): README with provenance, config, run, status

Documents the cookie-path worker: endpoint and headers mirrored from
the mm-diigo original, DIIGO_COOKIE secret setup (local .dev.vars vs
wrangler secret put), the inert-GET / POST-only-submit behavior, and
the manual test result (200, total 1674, 2026-10-06) with pointers to
the checklist and capsite notes.

Generated-by: opencode (GLM)

diigo-dump/README.md

@@ -0,0 +1,38 @@
+# diigo-dump
+
+Cloudflare Worker port of [`diigo-dump.mjs` in the mm-diigo repo](https://github.com/dckc/mm-diigo) (`projects/diigo-bak/diigo-dump.mjs`) — dump
+Diigo bookmarks, most-recently-updated first, via the browser session cookie
+rather than the static API key.
+
+## What it does
+
+One page: a page-number field and a dump button. Submitting POSTs to the
+worker, which fetches
+
+    https://www.diigo.com/interact_api/load_user_items
+        ?sort=updated&count=24&page_num=<page>
+
+with the session cookie and shows status, `total`, and the JSON items in a
+read-only `<pre>`. GET `/` is inert — dumps happen only on explicit submits.
+
+Provenance notes: the `user-agent` / `x-requested-with` headers and the
+`interact_api` endpoint mirror the original script; the ocap-style
+attenuation there (pathjoin/query/rateLimit in WebApp.js) is reduced here to
+a plain fetch with the cookie never exposed beyond this one call.
+
+## Configuration
+
+- Secret `DIIGO_COOKIE`: the `Cookie` header from diigo.com devtools.
+  - Local dev: `.dev.vars` (gitignored). Note wrangler reads it only at
+    startup — restart after edits.
+  - Deployed: `npx wrangler secret put DIIGO_COOKIE`.
+
+## Run
+
+    cd diigo-dump
+    npx wrangler dev --port 8788   # → http://localhost:8788
+
+Status as of 2026-10-06: manual integration test passes — 200, `total: 1674`.
+See the project ladder in ../capsite-checklist.md; context in
+../capsite-notes.md. This is the cookie path; the API-key path
+(diigo-ping, EmDash plugin) is still 401.