refactor(*): set whole repo up to date with latest hexgate version

[guillaume-hexamind]

Brings the repo in line with the latest hexgate release.

Renamed HEXGATE_KEY → HEXGATE_API_KEY

Updated every reference across code, config, scripts, and docs to match the env var name expected by current hexgate.

Fixed the hexgate version never upgrading

make install-hexgate guarded the install on a bare import hexgate, so a bumped pin in pyproject.toml was never applied (venv stayed on a stale version). It now always uv pip installs the extra so the pin (hexgate>=0.2.9) is enforced.

Surface agent/user bans to the frontend

A kill-switch ban now shows a clear message instead of a generic failure (or, for devops, nothing at all):

• agent-server — healthcare & devops wrappers catch AgentBannedError and emit a structured error carrying code / ban_type / target / reason; protocol.error() gained an optional details field.
• proxy — translators forward details; added the missing error branch to the Google ADK translator (also fixes any devops error previously being silently dropped).
• front-app — renders a ban as a neutral system notice (with the operator reason when present) rather than a red error.