Secure runtime observability defaults

[sylvesterdamgaard]

What changed

• Make TCP API, Prometheus metrics, and resource metrics opt-in by default.
• Keep the existing API/metrics port defaults for configurations that explicitly enable them.
• Run comprehensive validation during normal config loading so runtime catches the same blocking bounds errors as check-config.
• Update global settings docs to describe TCP API as disabled by default while local Unix socket management remains available.

Why

The previous defaults opened management/metrics surfaces and started resource sampling unless users explicitly disabled them. That was surprising for production containers and did not match parts of the documentation.

Validation

• git diff --check
• go test ./internal/config ./cmd/cbox-init could not be run locally because go is not installed in this environment.