feat: route nofxos data API calls through claw402 x402 payment

When CLAW402_WALLET_KEY env var is set, all nofxos.ai data API calls
(AI500, OI rankings, NetFlow, price rankings) are automatically routed
through claw402.ai with x402 USDC micropayment.

- provider/nofxos/claw402.go: x402 GET request client for data APIs
- provider/nofxos/client.go: claw402 mode support in doRequest()
- kernel/engine.go: auto-detect CLAW402_WALLET_KEY and enable routing
- mcp/payment/x402.go: MakeClaw402SignFunc helper

Without CLAW402_WALLET_KEY, falls back to direct nofxos.ai (backward compat).

provider/nofxos/client.go

@@ -25,6 +25,7 @@ type Client struct {
 	AuthKey string
 	Timeout time.Duration
 	mu      sync.RWMutex
+	claw402 *Claw402DataClient // If set, routes requests through claw402
 }
 
 var (
@@ -59,6 +60,13 @@ func NewClient(baseURL, authKey string) *Client {
 	}
 }
 
+// SetClaw402 enables routing requests through claw402 payment gateway.
+func (c *Client) SetClaw402(claw402Client *Claw402DataClient) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.claw402 = claw402Client
+}
+
 // SetConfig updates client configuration
 func (c *Client) SetConfig(baseURL, authKey string) {
 	c.mu.Lock()
@@ -85,14 +93,21 @@ func (c *Client) GetAuthKey() string {
 	return c.AuthKey
 }
 
-// doRequest performs an HTTP GET request with authentication
+// doRequest performs an HTTP GET request with authentication.
+// If claw402 client is configured, routes through claw402 payment gateway instead.
 func (c *Client) doRequest(endpoint string) ([]byte, error) {
 	c.mu.RLock()
+	claw402Client := c.claw402
 	baseURL := c.BaseURL
 	authKey := c.AuthKey
 	timeout := c.Timeout
 	c.mu.RUnlock()
 
+	// Route through claw402 if configured
+	if claw402Client != nil {
+		return claw402Client.DoRequest(endpoint)
+	}
+
 	url := baseURL + endpoint
 	if !strings.Contains(url, "auth=") {
 		if strings.Contains(url, "?") {