fix(tracing): authenticate to remote viewers, and write traces where they survive

[rdasilveiracabral]

Follow-up to #69. Two remaining reasons a Harbor run on a remote machine produced no usable traces.

1. Trace files were written to a directory that gets deleted

Harbor bind-mounts only /logs/agent and /logs/verifier from the host (harbor.models.trial.paths). Everything else under /logs lives in the container's writable layer, and trial containers are removed by default.

TRACES_DIR pointed at /logs/artifacts/traces, so the exporter worked perfectly and its output was destroyed moments later during cleanup. Observed directly in a running trial:

/logs/agent       -> /dev/nvme0n1p2   (host bind mount, survives)
/logs/artifacts   -> overlay          (container layer, deleted)

Traces now write to /logs/agent/traces/, which is host-mounted — and sit beside trajectory.json, where failure analysis actually looks.

2. Exporters could not authenticate to a non-loopback viewer

The viewer refuses writes from non-loopback clients unless NOOA_VIEWER_AUTH_TOKEN is set, and authenticates via Authorization: Bearer. No exporter sent that header, so remote streaming was impossible however the viewer was configured. Each post failed 403 and retried 3× with backoff, on every LLM call:

POST http://<viewer>:5001/v1/journal/blocks attempt 1/3 failed: HTTP Error 403: Forbidden — retrying in 1s
DROP: failed to export 3 span(s): HTTP Error 403: Forbidden

Adds nooa.tracing._viewer_auth, applied at the three call sites that talk to the viewer: the OTLP HTTP exporter, the litellm journal poster, and the reachability probe. With the token unset, no header is added — loopback development is unchanged.

Verification

Against a token-protected viewer, from a separate host:

request	result
POST /v1/traces without header	401
POST /v1/traces with Authorization: Bearer	200

Usage:

# viewer host
NOOA_VIEWER_AUTH_TOKEN=<token> nooa start-dev

# machine running the agent
NOOA_VIEWER_AUTH_TOKEN=<token> OTLP_ENDPOINT=http://<host>:5001/v1/traces

🤖 Generated with Claude Code