feat(10-01): implement pax8-factory config check + singleton

- isPax8Configured(): both PAX8_CLIENT_ID and PAX8_CLIENT_SECRET required
- getPax8Client(): throws exact error naming both env vars when missing;
  caches singleton Pax8Client instance
- _resetPax8Client(): test seam to clear the cached singleton
- follows appgate-factory.ts / 10-RESEARCH.md Pattern 2 verbatim

lib/services/pax8-factory.ts

@@ -0,0 +1,25 @@
+import { Pax8Client } from './pax8-client';
+
+let _client: Pax8Client | null = null;
+
+export function isPax8Configured(): boolean {
+  return Boolean(process.env.PAX8_CLIENT_ID && process.env.PAX8_CLIENT_SECRET);
+}
+
+export function getPax8Client(): Pax8Client {
+  if (_client) return _client;
+  if (!isPax8Configured()) {
+    throw new Error('PAX8 is not configured — set PAX8_CLIENT_ID and PAX8_CLIENT_SECRET');
+  }
+  _client = new Pax8Client({
+    clientId: process.env.PAX8_CLIENT_ID!,
+    clientSecret: process.env.PAX8_CLIENT_SECRET!,
+  });
+  console.log('[PAX8] Client initialized');
+  return _client;
+}
+
+// Test seam — reset the cached client (e.g. after rotating credentials).
+export function _resetPax8Client(): void {
+  _client = null;
+}