feat(host/mgmt): HTTPS + token auth by default (no loopback no-auth fallback)

The mgmt API already always serves HTTPS (the host identity cert), but on a
loopback bind with no token it ran unauthenticated — any local process could
drive it. Make auth required ALWAYS:

- new mgmt_token::load_or_generate(): token precedence is --mgmt-token > env
  PUNKTFUNK_MGMT_TOKEN > persisted ~/.config/punktfunk/mgmt-token > freshly
  generated 32-byte hex, persisted 0600 in KEY=VALUE form (so the bundled web
  console can source it directly as a systemd EnvironmentFile — one source of
  truth). config_dir() made pub(crate).
- parse_serve() resolves the token via load_or_generate() when unset, so a bare
  `serve` Just Works with auth on and no operator step.
- mgmt::run() drops the loopback no-token exemption and requires a token;
  require_auth()'s unauthenticated fallback now returns 401. The paired-cert
  (mTLS) branch is unchanged — Apple client + library auth unaffected.
- web /api proxy: 503 (legible) instead of forwarding an empty bearer.
- tests: test_app/test_app_native default a token, send() auto-attaches the
  bearer; blank-token test asserts the new "no token" refusal. 80 pass.
- docs: mgmt module doc + host.env.example reflect always-on auth + auto-gen.

Compiles, clippy/fmt clean, openapi no drift. Part B (bundle the web console into
apt, auto-wired to this token) follows.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/punktfunk-host/src/main.rs

@@ -27,6 +27,7 @@ mod library;
 mod m0;
 mod m3;
 mod mgmt;
+mod mgmt_token;
 mod native_pairing;
 mod pipeline;
 mod pwinit;
@@ -293,11 +294,12 @@ fn parse_serve(args: &[String]) -> Result<(mgmt::Options, Option<m3::NativeServe
         }
         i += 1;
     }
-    // Flag wins over the environment so a unit file can set a default and a shell override it.
+    // The mgmt API is HTTPS + token-authenticated ALWAYS (even on loopback). Resolve the token:
+    // the --mgmt-token flag (above) wins, else PUNKTFUNK_MGMT_TOKEN env, else the persisted
+    // ~/.config/punktfunk/mgmt-token, else a freshly generated + persisted one — so a bare `serve`
+    // Just Works with auth on, no operator step, and the bundled web console reads the same file.
     if opts.token.is_none() {
-        opts.token = std::env::var("PUNKTFUNK_MGMT_TOKEN")
-            .ok()
-            .filter(|t| !t.is_empty());
+        opts.token = Some(crate::mgmt_token::load_or_generate()?);
     }
     let native = native_port.map(|port| m3::NativeServe {
         port,