Version, authenticate and fully trace ecosystem calls (#273)

Every Nexus and Praxis request now carries the contract version, an
X-Requested-By identifying Maven, a correlation ID (generated per request
when the call is not part of a traced action), and a bearer token when
one is configured. Nexus/Praxis/Hexis config blocks grew an optional
token field, env-expandable so the secret stays out of the committed
config; the vendored hexis client predates bearer auth, so a configured
Hexis token logs a loud warning instead of pretending to authenticate.

Client failures are now a typed *ecosystemError carrying service,
operation and HTTP status, classifying unauthorized, contract-mismatch
and unreachable without matching on message text.

Trace records are written for resolution, discovery, confirmation and
execution — on failure as well as success — with status, duration,
correlation and causation ids, HTTP status and failure class, and the
utterance redacted to its length. Traces were never actually persisted
before: both trace writers used fact kind "system", which the store's
CHECK constraint rejects, and the error was discarded.

internal/config/config.go

@@ -461,18 +461,30 @@ func (c *Config) MCPServers() []mcp.ServerConfig {
 type PraxisConfig struct {
 	// URL — the Praxis HTTP API base URL (e.g. "http://localhost:9742").
 	URL string `json:"url,omitempty"`
+
+	// Token — the shared bearer token sent on every request. Empty ⇒ calls
+	// go out unauthenticated, which is only appropriate on a loopback or
+	// unix-socket transport. Supports ${VAR} expansion, so the secret lives
+	// in deploy/telegram.env, not in the committed config.
+	Token string `json:"token,omitempty"`
 }
 
 // NexusConfig — connection to the Nexus identity service.
 type NexusConfig struct {
 	// URL — the Nexus HTTP API base URL (e.g. "http://localhost:9740").
 	URL string `json:"url,omitempty"`
+
+	// Token — shared bearer token; see PraxisConfig.Token.
+	Token string `json:"token,omitempty"`
 }
 
 // HexisConfig — connection to the Hexis capability execution service.
 type HexisConfig struct {
 	// URL — the Hexis HTTP API base URL (e.g. "http://localhost:9741").
 	URL string `json:"url,omitempty"`
+
+	// Token — shared bearer token; see PraxisConfig.Token.
+	Token string `json:"token,omitempty"`
 }
 
 // RoutineConfig — one scheduled routine. Cron is a standard 5-field expression