feat(llm-proxy): mission containers reach their models through a key-adding proxy (flagged)

Container-tier missions held the platform's provider keys in their environment,
readable by an agent with Bash and public egress. With CLAWMATES_LLM_PROXY=1
(and CLAWMATES_LLM_PROXY_SECRET), a container instead holds a per-mission token
where each key was, ANTHROPIC_BASE_URL points at the server's proxy on :8089
(not published, not routed by Traefik), and the GLM/Kimi hops' base URLs are
rewritten in the mission's config copy. The proxy verifies the token
(HMAC(secret, mission_id) — stateless, survives redeploys), refuses it unless
the mission is running, swaps in the real credential and streams the response.

Spiked first on gw-04: Claude Code on a subscription OAuth token, given only a
placeholder and a base URL, sent nothing but POST /v1/messages there and
answered once the placeholder was swapped. Off by default; no behaviour change
until enabled.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

crates/cm-api/src/lib.rs

@@ -27,6 +27,7 @@ pub mod microvm_executor;
 pub mod microvm_turn_executor;
 pub mod continuous_research;
 pub mod delivery_secrets;
+pub mod llm_proxy;
 pub mod mission_delivery;
 pub mod podcast;
 pub mod mission_events;