feat(validator): add bare FastAgent + Pallas validator for Mnemosyne MCP

A self-contained sub-project under validator/ that wraps Mnemosyne's MCP
server in a single FastAgent. Use it to confirm — outside of Daedalus —
that Mnemosyne's MCP transport works, every tool registers, args/responses
round-trip, and an LLM can actually drive the tools.

The validator is its own Pallas-consuming project with its own pyproject
(pallas-mcp + fast-agent-mcp), agents.yaml, and fastagent.config.yaml —
matching the pattern used by Iolaus and other Pallas consumers. It does
not import Mnemosyne Python code; it only speaks MCP over HTTP.

The agent never sets workspace_id, so all calls run against the global
scope (libraries with workspace_id IS NULL). Workspace-scoped validation
will come once Daedalus's chat path is wired (Daedalus injects
workspace_id server-side, force-overwriting whatever the LLM produces).

Default model is openai.Qwen3.5-35B-A3B-UD-Q4_K_XL.gguf served by
llama.cpp at nyx.helu.ca:22079/v1. Token provisioning via
`python manage.py create_mcp_token --user <u> --name validator`.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

validator/fastagent.secrets.yaml.example

@@ -0,0 +1,22 @@
+# Mnemosyne Validator — secrets template
+#
+# Copy to fastagent.secrets.yaml and fill in real values. The .yaml is
+# gitignored; the .yaml.example is committed.
+
+# ── LLM provider keys ───────────────────────────────────────────────────────
+# Local llama.cpp doesn't authenticate, but fast-agent requires the key field
+# to be present. "0000" or any non-empty string is fine.
+openai:
+  api_key: "0000"
+
+# ── MCP server bearer tokens ────────────────────────────────────────────────
+mcp:
+  servers:
+    mnemosyne:
+      headers:
+        # Mnemosyne MCP server requires a bearer token when MCP_REQUIRE_AUTH=True.
+        # Provision one with:
+        #     cd ../mnemosyne
+        #     python manage.py create_mcp_token --user <username> --name validator
+        # then paste the printed token here (it is shown once and not retrievable).
+        Authorization: "Bearer paste-mcp-token-here"