feat: caller identity header templating (${caller.id}, ${caller.role})

[rodaddy]

Summary

• Adds ${caller.id} and ${caller.role} template variables for header and env values
• Templates expand at call time with the authenticated caller's identity
• Works in services.json headers (no credentials.json needed) and credentials.json overrides
• Per-caller pool connections when templates are present

Closes #30

Usage

services.json — inject caller identity for all users:

{
  "open-brain": {
    "backend": "http",
    "url": "http://10.71.20.49:3100/mcp",
    "headers": {
      "Authorization": "Bearer shared-key",
      "X-Agent-Id": "${caller.id}",
      "X-Namespace": "${caller.id}"
    }
  }
}

When bilby calls → X-Agent-Id: bilby, X-Namespace: bilby
When skippy calls → X-Agent-Id: skippy, X-Namespace: skippy

Test plan

• 969 tests pass (7 new template tests)
• Clean typecheck
• Templates expand in headers and env
• Unknown variables left unexpanded
• No mutation of original config
• No expansion when no caller context (backward compatible)

🤖 Generated with Claude Code