Harden setup UX for write-ready defaults

[thrr87]

Summary

• make setup write-ready by default with shared server-secret resolution (env > file)
• auto-generate and persist ~/.hoard/server.key (0600 best-effort) in setup/serve flows
• remove permissive setup fallback; setup now fails when server health never comes up
• upgrade hoard setup output to a structured summary with instruction status and Codex token guidance
• extend hoard setup --verify with secret readiness and write smoke checks (memory_write + cleanup)
• keep compatibility for config tokens even when secret-backed DB auth is available
• align README with new defaults

Config/API updates

• add write.server_secret_file default ~/.hoard/server.key
• add write.auto_generate_server_secret default true
• keep write.server_secret_env and env precedence

Tests

• add tests/test_server_secret.py
• extend setup UX tests for secret generation and fail-fast server health behavior
• add HTTP integration coverage for file-secret admin auth and config-token compatibility
• full suite passing locally: 115 passed