feat(reasoning): opt-in remote endpoints for distillation LLM and embedder (3.9.0)

[acidkill]

Summary

• Adds reasoning_training.allow_remote_endpoints (default false, env SURREAL_MEMORY_REASONING_ALLOW_REMOTE): an explicit opt-in that lets the distillation LLM endpoint (pattern naming), the distiller's embedding provider, and the stop hook's semantic dedup use a configured remote http(s) gateway (e.g. LiteLLM) instead of loopback-only servers.
• Adds Bearer authentication for the naming request: SURREAL_MEMORY_LLM_API_KEY is sent as Authorization: Bearer when set; loopback servers keep going keyless with no header; a remote endpoint allowed by the opt-in without a key warns at namer build time instead of failing.
• Config plumbing: new field round-trips through to_dict/from_dict/TOML save-load and is overridable via env; emitted in _reasoning_toml_lines after distill_llm_endpoint; docs/reference/config.md regenerated.
• Version bump 3.8.1 → 3.9.0 everywhere (16 files verified by scripts/pre_ship.py --only versions), CHANGELOG entry.

Why

The reasoning pipeline's loopback-only invariant exists so raw model thinking never leaves the machine by accident. That invariant also made it impossible to run the pipeline against a remote OpenAI-compatible gateway — the smem stack is moving off Titan onto k3s (run 010), where embeddings/rerank/LLM are served by LiteLLM over the network. This PR keeps the default byte-for-byte identical (opt-in off ⇒ no remote endpoint is ever used, exactly as before) while letting an operator widen the gate deliberately. The opt-in widens where traces may be sent, never what counts as a URL: non-http(s) schemes are refused either way, and the unconfigured probe fallback stays loopback-only regardless of the flag.

Test plan

• pytest tests/ -m "not stress" -n auto — 7334 passed, 4 skipped, 1 xfailed (new tests in test_reasoning_naming.py, test_reasoning_distiller.py, test_stop_hook.py, test_unified_config.py; TDD RED→GREEN)
• ruff check src/ tests/ clean; ruff format clean
• mypy src/ --ignore-missing-imports clean (354 files)
• python scripts/pre_ship.py --only versions — every version-bearing file at 3.9.0
• python scripts/gen_config_docs.py --check — reference up-to-date
• Manual: smem 3.9.0 installed via pipx on the production host; smem doctor green against the existing stack (default config ⇒ behavior unchanged)

Verified by

@acidkill