skaldsong: align env-var contract with app reality (pre-first-deploy)

skaldsong-dev surfaced three contract corrections before the first
deploy:

- WORLDTREE_TOKEN (outbound HTTP Bearer) was missing — separate code
  path from SKALDSONG_BIFROST_JWT_KEY (inbound HS256 verify) but
  same secret value.
- WORLDTREE_BASE_URL replaces SKALDSONG_WORLDTREE_API_URL (the
  former is what the app actually reads).
- SKALDSONG_HOST_WIZARD_AGENT_ID was missing entirely — must pin to
  skaldsong:wizard-v2 to inherit the existing Worldtree agent slot;
  blank would burn another slot of the 50-per-key Heimdall quota.

stacks/skaldsong/compose.yaml

@@ -47,9 +47,22 @@ services:
       # required if host:port changes.
       SKALDSONG_HOST_BIFROST_ENDPOINT_URL: "${SKALDSONG_HOST_BIFROST_ENDPOINT_URL:-}"
 
-      # URL skaldsong uses to call Worldtree's conversation API. From
-      # ana-docker, this is corviduo-dev's IP:port LAN-direct.
-      SKALDSONG_WORLDTREE_API_URL: "${SKALDSONG_WORLDTREE_API_URL:-http://10.250.50.152:8080}"
+      # Worldtree API client. WORLDTREE_TOKEN is the SAME shared-secret
+      # Bearer as SKALDSONG_BIFROST_JWT_KEY above — different code path
+      # consumes it (outbound HTTP Authorization header vs inbound HS256
+      # JWT verify). WORLDTREE_BASE_URL is corviduo-dev's IP:port
+      # LAN-direct from ana-docker.
+      WORLDTREE_TOKEN: "${WORLDTREE_TOKEN:-}"
+      WORLDTREE_BASE_URL: "${WORLDTREE_BASE_URL:-http://10.250.50.152:8080}"
+
+      # Wizard agent ID on Worldtree. MUST be pinned to the existing
+      # agent slot (`skaldsong:wizard-v2` per skaldsong-dev's prior
+      # hand-launched setup); leaving blank on first boot would POST
+      # /agents/define and burn another slot of the 50-agent-per-key
+      # Heimdall quota. Heimdall scopes agent_id to user_id, so the
+      # ana-docker deployment inherits the same id as the nh3-dev
+      # hand-launch.
+      SKALDSONG_HOST_WIZARD_AGENT_ID: "${SKALDSONG_HOST_WIZARD_AGENT_ID:-skaldsong:wizard-v2}"
 
       # CORS for the SPA. Comma-separated origins; include both the
       # public hostname and any dev origins still in rotation.