Fix empty Bearer on netx__* by waiting for credentials.

Inject credentials before publish, read the live token per HTTP request, and surface netx_token_missing instead of a silent 401.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/agent-tools.ts

@@ -31,7 +31,12 @@ export function apply(ctx: Context): void {
       return
     }
     unregister = registerNetxTools(ctx, connection)
-    ctx.logger.info('netxops-tools: registered netx__* for Ops preset → %s', connection.apiUrl)
+    const tokenConfigured = connection.token.trim().length > 0
+    ctx.logger.info(
+      'netxops-tools: registered netx__* for Ops preset → %s tokenConfigured=%s',
+      connection.apiUrl,
+      tokenConfigured,
+    )
   }
 
   remount()