fix: fall back to lan mode in pic_ngo Caddyfile when token is empty

On a fresh install before DDNS registration completes, ddns.token is
empty. Writing `token ` (bare keyword, no value) causes Caddy to reject
the Caddyfile at startup with "wrong argument count or unexpected line
ending after 'token'".

Guard added: if the token is empty, generate a LAN-mode Caddyfile so
Caddy starts cleanly. The Caddyfile is regenerated automatically once
registration completes and the token is persisted to cell_config.json.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_caddy_manager.py

@@ -640,6 +640,31 @@ class TestCaddyfileLanCustomCert(unittest.TestCase):
         self.assertNotIn('/etc/caddy/internal/cert.pem', out)
 
 
+class TestPicNgoNoTokenFallback(unittest.TestCase):
+    """pic_ngo mode with no token falls back to lan so Caddy starts cleanly."""
+
+    def test_empty_token_generates_lan_caddyfile(self):
+        mgr = _mgr()
+        mgr.config_manager.configs = {'ddns': {'token': '', 'url': 'https://ddns.pic.ngo'}}
+        with patch.dict(os.environ, {}, clear=False):
+            os.environ.pop('DDNS_TOKEN', None)
+            os.environ.pop('DDNS_URL', None)
+            out = mgr.generate_caddyfile({'cell_name': 'x', 'domain_mode': 'pic_ngo'}, [])
+        self.assertIn('auto_https off', out)
+        self.assertNotIn('dns pic_ngo', out)
+        self.assertNotIn('token', out)
+
+    def test_missing_ddns_config_generates_lan_caddyfile(self):
+        mgr = _mgr()
+        mgr.config_manager.configs = {}
+        with patch.dict(os.environ, {}, clear=False):
+            os.environ.pop('DDNS_TOKEN', None)
+            os.environ.pop('DDNS_URL', None)
+            out = mgr.generate_caddyfile({'cell_name': 'x', 'domain_mode': 'pic_ngo'}, [])
+        self.assertIn('auto_https off', out)
+        self.assertNotIn('dns pic_ngo', out)
+
+
 class TestDdnsApiStripsLegacySuffix(unittest.TestCase):
     """_caddyfile_pic_ngo strips /api/v1 from ddns_api so the plugin doesn't double it."""