fix(server): identify agent calls with the machine's formae client id

[JeroenSoeters]

Summary

• Agent calls now identify themselves with the machine's real formae client id instead of a shared literal: a new internal/clientid resolver reads ~/.pel/formae/cli_client_id (the id the formae CLI persists), validates it as a single header-safe token, and caches it for the process lifetime. When the file is missing or invalid it falls back to the previous "formae-mcp" literal, uncached, so a later call picks up the file once it exists; a command never fails because of identity plumbing. The resolver never executes a binary.
• All six command call sites (apply, destroy, destroy-by-query, cancel, command status, list) send the resolved id as Client-ID; client:me from this server now means "this machine, shared with the CLI" when the id file exists.
• Documents formae's new user: command-query key in every hand-maintained copy of the grammar (tool description, input schema, query-syntax resource): user:me rides the bearer token and means the human; a UUID or KSUID value matches the subject id; anything else matches the display name.

[JeroenSoeters]

Held until the next formae release ships: the query-key documentation in this PR describes the user: key, which agents released before that do not parse. The client-id change has no release dependency and can be split out if it is needed sooner.