Command API configuration guard

Parent

Closes part of #281; parent remains open.

What to build

Make the legacy Command API a safe, explicitly enabled compatibility capability. A fresh deployment must keep it disabled. If enabled, configuration must require a dedicated command token and loopback-only exposure, failing safely before an unprotected endpoint can start.

Acceptance criteria

• Command API enablement defaults to disabled.
• A missing or empty command token makes enabled configuration invalid.
• Enabled configuration is valid only for 127.0.0.1 or localhost.
• Non-loopback enablement is rejected as a configuration error.
• Configuration exposes typed values to the existing application boundary.
• Unit tests cover defaults, valid enablement, missing token and non-loopback host.
• Existing configuration behavior remains compatible when the feature is disabled.

Blocked by

None (can start immediately).