feat: traced fetch target + error category attrs

[vreshch]

Two more flat fields on every error line, lifted in the shared captureError path, so
Express, Next and MCP emitters gain them with no call-site change.

category (always present)

Root cause bucketed into timeout / connectivity / db / logic - the first split on
an error dashboard: is it them, or is it us. Classified from the ROOT cause via the
existing rootCauseOf, so a TypeError: fetch failed wrapper never hides the ENOTFOUND
underneath. db is a SQLSTATE (/^[0-9A-Z]{5}$/, e.g. 23505, 42P01) checked AFTER the
timeout/connectivity sets, so five-char codes like EPIPE are not misread as SQLSTATE.
Anything unrecognised is logic: our bug until proven otherwise.

target (absent when unknown)

What an outbound call was reaching for: POST api.test:8443/v1/memories/:id. Computed
BEFORE the await (the rejection itself never says which call failed) and attached by
tracedFetch as a non-enumerable fetchTarget, same defineProperty pattern as
callSite, skipped if already present. targetOf finds it through any wrapping cause
chain. Host keeps its port; query, hash and credentials never appear.

Notes for review

• Path templating REUSES routeFromUrl from span-names.ts rather than duplicating the
  rule, so a target and its fetch span name group identically. Its id regex is hex {8,},
  not the >=12 in the brief - one templating rule across the kit beat the exact
  threshold. Strictly a superset: it templates more, never less.
• errorFrameFields OMITS absent keys rather than emitting empty strings. The brief asked
  to mirror how 0.13 handles absent, and 0.13 omits (cause/frame are dropped by pino
  when undefined) - so target omits too. category is the exception: always set.
• New exports: categoryOf, targetOf, fetchTargetOf, type ErrorCategory.

npm run verify green: type-check, lint, format, 217 tests, build, dist smoke (extended
with the new exports).