Add HMAC-SHA256, base64url, uuid_v4, unix_timestamp, json encode/decode, http auth builtins for soma-license

New builtins in dispatch_builtin:
- hmac_sha256(secret, data) -> String (hex)
- base64_url_encode(s) / base64_url_decode(s) -> String
- unix_timestamp() -> Int
- uuid_v4() -> String (alias for uuid_new)
- json_encode(v) / json_decode(s) -> polymorphic
- json_get_string(obj, key), json_get_int(obj, key), json_get_array(obj, key)
  — work on both Value::Map and Value::Struct (json_parse returns Struct)
- http_get_auth(url, token), http_put_auth(url, token, body), http_delete_auth(url, token)
- string_split_last(s, delim) -> [before, after] on last occurrence
- array_get(arr, idx) -> element

http_serve upgraded to general-purpose router: passes all requests to
handle_request(method, path, body) — not just /axon/message. Method, path,
body stored in GLOBAL_STATE before calling callback; handle_request receives
them as positional args via initial_stack.

env() now returns "" (not Nil) when var is unset — enables `env("X") == ""`
comparisons in Engram code.

run_sub_interpreter_with_stack() added to support pre-pushing args onto the
call stack before entering a function.

Fix pre-existing non-exhaustive match errors in el-fmt, el-types, el-arch
for Retry, Deploy, With, Reason, Parallel, Trace, Activate AST nodes.

Register all builtins in TypeEnv::with_builtins() to eliminate type-checker
warnings for builtin calls.

Cargo.toml

@@ -54,3 +54,7 @@ reqwest     = { version = "0.12", features = ["json", "blocking"] }
 uuid        = { version = "1", features = ["v4"] }
 walkdir     = "2"
 tiny_http   = "0.12"
+hmac        = "0.12"
+sha2        = "0.10"
+hex         = "0.4"
+base64      = "0.22"