AMI missing configuration exposes admin/admin on every interface

[ryanmurf]

Problem\n\nA missing or unreadable manager.conf enables AMI on 0.0.0.0:5038 and injects admin/admin. A present file with no users also injects that credential, and an invalid bind string falls back to the wildcard address.\n\nAMI is not an IETF SIP protocol and has no governing RFC. The security behavior to match is the production stack control plane: disabled unless explicitly configured, password-backed, and loopback-bound by default.\n\n## Expected\n\n- library and CLI defaults are disabled and loopback-bound\n- missing/unreadable config creates no user and no listener\n- enabled=yes without a configured user is forced disabled\n- omitted/invalid bind address cannot expose a wildcard listener\n- no built-in AMI credential exists\n\n## Regression tests\n\nCover defaults, missing and unreadable files, explicit enablement without users, and explicit enablement with a user but omitted bind address.

[github-actions]

🤖 Auto-triage: Automated evaluation failed. A human should review this issue.

Error

GitHub Models API returned 401: {"error":{"code":"unauthorized","message":"Bad credentials","details":"Bad credentials"}}

[ryanmurf]

Fixed by #67 (merged).