feat: ProtocolSettlement sends X-ATXP-App-Name header to auth

[badjer]

Summary

Companion to auth#254. ProtocolSettlement now sends an X-ATXP-App-Name header on every /settle/* and /verify/* request so auth can attribute settlement observability events to the calling service (llm, music, search, etc.).

ProtocolSettlement has two construction sites in this repo:

1. Direct — callers like LLM construct it themselves.
2. Inside atxpExpress — the express middleware instantiates it per-request for tool servers using @atxp/express.

This PR plumbs appName through both paths:

• New ProtocolSettlementOptions with appName?: string as the 5th (options bag) arg on the constructor. Positional-compatible, no breaking change.
• New appName?: string field on ATXPConfig so atxpExpress({ appName: 'music' }) works.
• atxpExpress.ts:124 forwards config.appName into new ProtocolSettlement(...).

Resolution order

Documented on both ProtocolSettlementOptions and ATXPConfig:

1. explicit option value, if non-empty after trim
2. process.env.APP_NAME, if non-empty after trim
3. header omitted

An explicit empty string ({ appName: '' }) disables the env fallback — useful for tests and multi-service processes.

Why env fallback?

Follows the SDK's existing Pattern-A precedent — NODE_ENV drives the default for allowHttp / allowInsecureRequests across oAuthResource.ts, atxpFetcher.ts, atxpClient.ts, serverConfig.ts, with explicit options exposed as overrides. This is the established convention for non-secret env-driven defaults. (Pattern B — silent env reads with no API exposure — is reserved for secrets like ALCHEMY_API_KEY and ATXP_OPAQUE_KEY.)

Practical benefit: every service in our ecosystem already sets APP_NAME for turtle's PostHog events. With this SDK bump, auth-side observability attribution works with zero code changes in LLM, tool servers, etc.

Implementation notes

• appName added to BuildableATXPConfigFields alongside minimumPayment — both are optional fields that have no DEFAULT_CONFIG value, consistent precedent.
• Resolved once in the constructor (not re-read per request) so mid-process process.env mutation can't change behavior mid-flight.
• Added to both verify() and settle() for consistency — both are observability surfaces auth would want attributed.

Test plan

• npx vitest run src/protocol.test.ts in atxp-server — 33/33 passing (7 new under X-ATXP-App-Name header describe):
  • sends header when explicit option set
  • falls back to process.env.APP_NAME
  • explicit option overrides env
  • explicit empty string disables env fallback
  • omits header when neither set
  • trims whitespace-only values to undefined
  • applies to verify() as well as settle()
• npx vitest run in atxp-express — 45/45 passing
• Package-wide: atxp-server (15 files), atxp-express (4), atxp-common (12), atxp-client (17) — all passing
• npx tsc --noEmit — clean in atxp-server and atxp-express
• npm run lint — clean, no new warnings

Rollout

1. Merge + release this SDK change.
2. Auth-side PR (auth#254) merges — auth starts reading the header (no-op until SDK rollout).
3. Bump @atxp/server / @atxp/express in LLM, tool servers, any ProtocolSettlement consumers.
4. Build the "Payment revenue by app" Honeycomb dashboard keyed on payment.app_name.