Sign the completion and the probe with the same token (V-673)

llm.Client carries a bearer credential and sets it on the completion, and
Pair signs the /health probe with it too. An unsigned probe would answer 401,
Pair would read that as a card that is busy, and every workstation turn would
fall back to the resident model with nothing naming why.

The token comes from workstation.token, expanded from MAVEN_GPU_TOKEN like
every other secret in that file. Missing, and voicewire says so at startup:
the fallback is silent by design and this failure would otherwise be
invisible.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ESv8hqNPseYt1CnotZpqDz

internal/config/workstation.go

@@ -27,6 +27,13 @@ type WorkstationConfig struct {
 	// signal, so it must be the supervisor's endpoint and not llama-server's.
 	Health string `json:"health,omitempty"`
 
+	// Token — the bearer credential mavgpud requires, expanded from the
+	// environment like every other secret here. It is what stops anything on
+	// the LAN spending the card, so a URL that is not loopback needs one.
+	// Wrong or missing reads as a workstation that is down, and Maven falls
+	// back to the resident model.
+	Token string `json:"token,omitempty"`
+
 	// Probe — how often admission is re-checked. 0 ⇒ DefaultWorkstationProbe.
 	// Nothing on the hot path waits for it: the answer is cached and read
 	// atomically, so this only sets how late Maven notices the card came back.