Run context headers

For provider_event, the proxy emits:

Header	Value source
x-agentic-charge-token	HMAC-SHA256 signed context token.
x-agentic-charge-run-id	JSON-RPC call ID generated by the proxy.
x-agentic-charge-mcp-id	Marketplace entry UUID.
x-agentic-charge-selection-id	Agent MCP selection UUID.
x-agentic-charge-max-total-usd	MCP_PROVIDER_DEFAULT_MAX_CHARGE_USD.

The signed token payload contains runId, buyer user ID/email, provider user ID, MCP ID, selection ID, optional tool name, max total charge, and expiry.

The backend rejects malformed signatures, expired tokens, mismatched URL run IDs, and provider-account mismatches.

The current default token lifetime is controlled by MCP_PROVIDER_CONTEXT_TTL_SECONDS and defaults to 3600 seconds. The default run charge cap is controlled by MCP_PROVIDER_DEFAULT_MAX_CHARGE_USD and defaults to 50 USD. Deployments can override both values.