fix(examples): indonesia_compliance reads AXONFLOW_USER_TOKEN [skip-runtime-e2e]

[saurabhjain1592]

Summary

examples/indonesia_compliance.py hardcoded user_token="" — on enterprise stacks (DEPLOYMENT_MODE=enterprise) the governed NIK call 401'd and the generic AxonFlowError catch printed the auth failure as "expected if no LLM configured" with exit 0. This is the swallowed-auth-error class from the #2861 sweep; this file was missed by #213's example fixes.

Changes

• examples/indonesia_compliance.py: read AXONFLOW_USER_TOKEN (matches every other example post-fix: interceptor sync bridge + async detection, example fixes #213); re-raise AuthenticationError so a credentials problem fails loudly instead of masquerading as a missing-LLM situation.

Testing (live enterprise stack, axonflow-enterprise main @ 5222c70f0, local editable SDK 8.5.1)

• With a valid tenant JWT: exit 0, NIK request governed (Response blocked: False), audit-search + PII-Indonesia policy list legs green.
• With the token unset: loud AuthenticationError: Invalid credentials, exit 1 (previously exit 0 with a success-shaped message).

Skip-runtime-e2e justification

One-hunk example-script fix (env-var read + loud auth failure); no library surface changed. The governed-call path this example exercises is already covered by the repo's runtime-e2e suite; the fix itself was verified end-to-end against a live enterprise stack in both directions (evidence above). Adding a dedicated runtime-e2e harness for a demo script would duplicate existing coverage.

Refs getaxonflow/axonflow-enterprise#2861.

[saurabhjain1592]

Refreshed verification to current (2026-08-03), platform line v9.13.0:

• Branch updated onto current main (head f79227d), full CI re-ran fresh today: all 17 checks green (CI, Contract Tests, Demo Scripts Validation, wire-shape-contract, DoD gates, CodeQL, DCO, heartbeat real-stack on ubuntu/windows/macos). PR checks: https://github.com/getaxonflow/axonflow-sdk-python/pull/215/checks
• The live community-stack job skips on PR events, so it was additionally dispatched on this branch: run https://github.com/getaxonflow/axonflow-sdk-python/actions/runs/30836420847 - boots the stack from getaxonflow/axonflow main (= v9.13.0), runs tests/test_integration.py plus the quickstart and gateway_mode examples live: all green.
• Hostile re-read of the diff: AuthenticationError subclasses AxonFlowError (axonflow/exceptions.py:24) and the client maps 401s to it (axonflow/client.py:824,911), so the specific-before-generic except ordering is correct and the re-raise leg is live.
• Cross-SDK consistency verified on current mains: same env var AXONFLOW_USER_TOKEN everywhere; Go uses the identical default-empty pattern (examples/indonesia_compliance/main.go reads getEnv("AXONFLOW_USER_TOKEN", "")); Java (chore(ci): cancel orphaned PR runs + prune Python matrix on PR #194, merged) reads the same var, omits it when unset (SDK anonymous fallback), and fails loud on auth rejection - same absence semantics this PR adopts.

Merging per backlog-clearance brief.