fix(phase6): demo-data fallback when Supabase env vars missing

[vorionsys]

Summary

Two related fixes for the Phase 6 Trust Engine Integration Test job.

1. apps/agentanchor/app/api/phase6/stats/route.ts
getPhase6Service() throws `Error('Missing Supabase configuration for Phase 6 service')` when `NEXT_PUBLIC_SUPABASE_URL` / `SUPABASE_SERVICE_ROLE_KEY` are unset (which they are in the integration-test and load-test CI jobs). That call was outside the inner try/catch that has the demo-data fallback, so the throw went straight to the outer catch and the route returned HTTP 500 `{"error": "Failed to fetch Phase 6 statistics"}`. Move the service instantiation inside the inner try so missing-config errors fall back to demo data — matching the stated intent of the fallback block.

2. packages/car-python/vorion_car/client.py
The HTTP error parser assumed every error body was shaped `{"error": {"message": "..."}}`, but our API returns `{"error": "..."}`. When the Python SDK hit the 500 above, it crashed with `AttributeError: 'str' object has no attribute 'get'` instead of raising a useful `CARError`. Handle both dict and string shapes.

Impact

• Unblocks the Integration Test job in `ci-phase6.yml`.
• The Load Test job (nightly-only, not blocking PRs) hits additional phase6 endpoints (role-gates, ceiling, provenance, alerts) that don't have demo fallbacks. That'll need a separate fix — either add demo fallbacks everywhere, restrict k6 smoke to `/stats` only, or supply real Supabase creds in CI.

Test plan

• CI Integration Test job goes green
• Existing tests in `apps/agentanchor/tests/api/phase6.test.ts` still pass
• Python SDK unit tests still pass (if any exist for `_request` error handling)