fix(security): guard legacy command API configuration

Summary

• Add typed command API settings that default to disabled and reject enabled configurations without a token or loopback host.
• Return 404 while disabled, require the configured token with a constant-time comparison, and bind to loopback when enabled.

Validation

• python3 -m unittest discover -s tests -v (5 passed)
• python3 -m py_compile command_api_config.py hexstrike_server.py
• git diff --check

Closes #282