refactor(harness): renaming prodotto tht (Onda -1)

Thoth (tht) è il prodotto, PSD è il cliente. Nessun riferimento al contesto
clinico nel codice.

Rinomine:
- comando+package nsp→tht (dir nsp/→tht/, 46 import, pyproject entry point)
- gate nsp-gate.js→tht-gate.js (+ rewrite token, relayIfNspFails→relayIfThtFails)
- workspace chirone.{example,test}.yaml→tht.{example,test}.yaml (generici)
- env THOTH_→THT_ (19 var) + NSP_ stragglers (NSP_HARNESS_ROOT, NSP_SESSION)
- commenti/docstring chirone/psdwp3/policlinico neutralizzati ('the reference
  implementation', 'the DWH')

Aggiunto [tool.setuptools.packages.find] include=['tht*'] (necessario: l'auto-
discovery rompeva con tht/ + workspaces/ come top-level multipli).

.env operatore aggiornato in-place (prefissi THT_, valori preservati, gitignored).

Verifica: pytest 109 passed, npm test 14 pass, tht phase meta --json OK, zero
residui nsp/THOTH_/NSP_/chirone nel package.

harness/tests/conftest.py

@@ -7,14 +7,14 @@ from dotenv import load_dotenv
 from sqlalchemy import create_engine
 from testcontainers.postgres import PostgresContainer
 
-# Permetti `pytest` lanciato da qualsiasi directory di trovare il package `nsp`
+# Permetti `pytest` lanciato da qualsiasi directory di trovare il package `tht`
 # (installato in modalità editable nella venv, ma utile anche senza attivazione).
 _ROOT = Path(__file__).resolve().parent.parent
 if str(_ROOT) not in sys.path:
     sys.path.insert(0, str(_ROOT))
 
 # Directory sessions/ risolta relativamente alla root harness (per i test che creano sessioni)
-os.environ.setdefault("NSP_HARNESS_ROOT", str(_ROOT))
+os.environ.setdefault("THT_HARNESS_ROOT", str(_ROOT))
 
 # L2 tests need the remote credentials from harness/.env (gitignored). Loaded once,
 # autouse, before any test. L0/L1 tests don't read these vars; missing .env only
@@ -23,10 +23,10 @@ load_dotenv(_ROOT / ".env")
 
 # L2 connection prerequisites (spec Testing Strategy). If any is missing/empty, L2
 # tests are SKIPPED (not failed) so the default run (pytest = L0+L1) stays green.
-# NOTE: THOTH_SSL_CA is NOT required -- the DWH endpoint presents a public cert
-# (*.policlinicosandonato.it signed by GoDaddy), already in the certifi bundle, so
+# NOTE: THT_SSL_CA is NOT required -- the DWH endpoint presents a public cert
+# signed by a public CA (GoDaddy), already in the certifi bundle, so
 # the clients fall back to verify=True and TLS validates without a CA file.
-REQUIRED_L2 = ["THOTH_DWH_API_KEY", "THOTH_VEC_API_KEY", "THOTH_VEC_WRITE_API_KEY"]
+REQUIRED_L2 = ["THT_DWH_API_KEY", "THT_VEC_API_KEY", "THT_VEC_WRITE_API_KEY"]
 
 
 @pytest.fixture(scope="session")