feat: integrate external Conduit MCP service

[devXyi]

What this does

• Adds a standalone Prexus-side Go client for the external devXyi/conduit-mcp service.
• Uses Conduit's documented Auth0 client-credentials flow and Streamable HTTP MCP session.
• Adds a guarded /conduit/tools endpoint for read-only integration verification.
• Adds a dedicated conduit:read RBAC permission.
• Keeps Meteorium/risk routing unchanged for safety.

Architecture

Prexus consumes Conduit as an external MCP service; Conduit is not copied into or owned by Prexus.

Safety

No existing risk endpoint, Supabase path, JWT auth path, or Meteorium routing is changed by this branch. The Conduit integration remains inactive until CONDUIT_CLIENT_ID and CONDUIT_CLIENT_SECRET are configured.

Note

Render environment entries for Conduit are intentionally not applied automatically in this branch because the current Render service naming in render.yaml does not match the live service naming and should not be changed blindly.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.