feat: add NKey auth to local NATS server

[mfethe1]

Problem

The local NATS server running on mack (port 4222) has no authentication configured. Any process with network access to the machine can publish/subscribe to all subjects including swarm.events, AGENT_EVENTS, and heartbeat subjects.

Current state

• homebrew.mxcl.nats-server plist starts NATS with JetStream enabled but no auth
• memu/gateway_federation.py connects to nats://localhost:4222 — no credentials
• openclaw_hostd connects to nats://localhost:4222 — no credentials

Desired state

• NATS server configured with NKey-based auth
• fumemory/.env updated with NATS_LOCAL_CREDS or NATS_LOCAL_NKEY
• All local clients (memu, hostd, gateway_federation) updated to pass credentials
• launchd plist for NATS updated with config file path

Why NKey

NKeys are Ed25519 keypairs — self-signed, no PKI needed, standard NATS security primitive. Appropriate for a single-host setup before federation hardening.

Acceptance criteria

• NATS server starts with NKey auth enabled
• memu/gateway_federation.py authenticates successfully
• openclaw_hostd authenticates successfully
• Local memu API (localhost:8000/health) still responds after config change
• NATS connection refused for unauthenticated clients

Context

This is a local-host-only gap (NATS is not exposed externally). Low urgency but required for production hardening of the mack memory stack.