feat(guardrails): add NeMo Provider

[christinaexyou]

Refactor of praxis-proxy/praxis#700

Implements the NeMo provider for the ai_guardrails filter, completing request-side evaluation against NeMo Guardrails. Addresses #48.

The following changes were made:
providers/nemo.rs

• Implements NemoProvider which sends a POST to the configured /v1/guardrail/checks endpoint and maps the NeMo response to a GuardResult

filter.rs

• on_request_body which checks phase.request (default true), waits for end_of_stream, parses the body, calls extract_messages, invokes the provider, and acts on the verdict:

  Pass → Continue
  Block → Reject 403 with the blocked rail name(s) in the body
  Redact → Continue (body replacement placeholder for ai_guardrails: NeMo mask / redact action #49)

• extract_messages: parses OpenAI Chat Completions API formats, returns FilterError for unsupported formats

[praxis-bot-app]

Missing Signed-off-by: 25b82fc. All commits require sign-off (via git commit --signoff).

[praxis-bot-app]

Unsigned commits: 3803297. Please sign your commits.

[praxis-bot]

NeMo Provider Review

Solid implementation of the NeMo guardrails provider with correct request-side integration, good error handling structure, and functional integration tests covering all three verdict paths plus provider-down scenarios.

Findings

#	Severity	File	Summary
1	Large	nemo.rs	Content-Length size check bypassed for chunked responses
2	Large	nemo.rs	No unit tests for map_nemo_response or blocked_rail_names
3	Large	filter.rs	No unit tests for extract_messages
4	Large	tests.rs	Only happy-path on_request_body test; no block/redact/error path tests
5	Medium	nemo.rs	Short-form separator comment
6	Medium	filter.rs	Short-form separator comment

Non-inline findings

[Medium] filters/src/guardrails/filter.rs and examples/configs/nemo-guardrails.yaml are both missing POSIX trailing newlines (\ No newline at end of file in the diff). Add a final newline to each.

[praxis-bot]

[Large] extract_messages has no unit tests. Add tests for:

• Valid body with "messages" array (happy path)
• Invalid JSON (verify error message)
• Valid JSON without a "messages" key
• "messages" present but not an array (e.g. a string)
• Empty "messages" array (should succeed, returns empty vec)