feat(admin): add tri-state AdminAreaAuth setting with default-creds guard rail

First piece of the #419 admin-area gate: a persisted, live-reloadable
tri-state setting ("" unset / "enabled" / "disabled") so a later release
can flip the default from open to gated without breaking an explicit
opt-out. Rejects enabling while MGMT_USERNAME/MGMT_PASSWORD are still the
published default, since that would give a false sense of security.

No behavior change yet — nothing reads this field to actually gate
anything. That's the next chunk.

Refs #419

cmd/soundtouch-service/main.go

@@ -529,6 +529,11 @@ func main() {
 			server.SetAmazonConfig(config.amazonClientID, config.amazonClientSecret, config.amazonRedirectURI)
 			server.SetMgmtConfig(config.mgmtUsername, config.mgmtPassword)
 
+			// Invalid values (e.g. a hand-edited settings.json) fall back to the
+			// unset default rather than failing startup.
+			adminAreaAuth, _ := handlers.NormalizeAdminAreaAuth(persisted.AdminAreaAuth)
+			server.SetAdminAreaAuth(adminAreaAuth)
+
 			initMusicServices(config, server)
 			initTTSService(config, server)