Support API: record acting agent on every write (traceability) + per-agent API keys

Elazar CLI 2026-09-22. Agent writes through each app's support API (mars, pluto, venus, terra, enamel) are recorded with Elazar's admin user as the actor. Each write must also store the acting agent's name (the X-Acting-Agent header) plus the ticket/request ref, in a field users never see, so every action traces to one agent. Follow-up: one API key per agent instead of one shared SUPPORT_API_KEY per app, so the agent name is proven by the key rather than self-declared. DoD: each app's audit trail shows the agent name for every support-API write, and per-agent keys are issued.