feat: verification hardening — per-key traces, stream guardrails, tunable thresholds (C6/C8/C3)

[MANVENDRA-github]

Closes the remaining verification/quality gaps from the v0.1.x audit.

What changed

• Per-key trace isolation (C8): new self-scoped GET /v1/traces (+ /v1/traces/:id) gated by
  the client's own Sentinel key, forcing apiKeyHash = hash(callerKey) server-side so a key
  sees only its own traces (admin GET /traces still sees all). Adds a TraceQuery.apiKeyHash
  filter to both stores (+ a SQLite index). Resolves the SR-002 deferral.
• Opt-in inline guardrails on streaming (C6): GUARDRAILS_STREAM_BUFFER=true buffers a
  streamed response and runs guardrails before any byte is sent, blocking (422) on a violation.
  Off by default — live streaming keeps first-byte latency.
• Configurable routing thresholds (C3): routing.thresholds tunes the auto complexity
  boundaries (defaults unchanged when omitted) — "config over code".
• Real judge evidence: docs/EVIDENCE.md captures a real async-judge run against a local
  Ollama (qwen2.5:0.5b) — good answer → 5, off-topic answer → 2.

Tests

• store apiKeyHash filter (both backends); end-to-end /v1/traces isolation (a key sees only
  its own, another key's id 404s, no key 401s); buffered streaming guardrails (422 block +
  clean pass-through); classifier honours custom thresholds.

Security: SECURITY_REVIEW_LOG SR-009 (forced server-side scope; streaming-bypass closed).

How to verify

• pnpm verify → green (239 tests, coverage ≥90%)
• pnpm build → green

Defaults are unchanged: no GUARDRAILS_STREAM_BUFFER, no routing.thresholds, and the
self-scoped endpoint is additive — existing behavior is untouched.