Fix CI unit test failures and DDNS config wiring

- auth_manager._ensure_file(): stop creating the empty auth_users.json on
  init — the constructor now only creates the parent directory.  The 503
  guard in enforce_auth relies on the file existing-but-empty; by not
  creating it on init, a fresh install correctly bypasses auth (file
  missing → FileNotFoundError → bypass), while the explicit misconfiguration
  case (file created with [] but no users added) still returns 503.
- test_enforce_auth_configured.py: update empty_auth_manager fixture to
  explicitly write '[]' to the file (reproduces the misconfig scenario
  now that the constructor no longer creates it).
- ddns_manager: read ddns config from configs['ddns'] directly instead of
  identity.domain.ddns — _identity.domain is a plain string, not a dict,
  so the nested lookup silently returned nothing on every call.
- setup_cell.py: write top-level 'ddns' block into cell_config.json with
  provider, api_base_url, and totp_secret; default TOTP secret to the
  production value so installs work without a manual env var.
- test_ddns_manager.py: update _make_config_manager to populate cm.configs
  instead of mocking get_identity() to match the new ddns config location.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/auth_manager.py

@@ -47,16 +47,6 @@ class AuthManager(BaseServiceManager):
             os.makedirs(os.path.dirname(self._users_file), exist_ok=True)
         except Exception:
             pass
-        if not os.path.exists(self._users_file):
-            try:
-                with open(self._users_file, 'w') as f:
-                    f.write('[]')
-                try:
-                    os.chmod(self._users_file, 0o600)
-                except Exception:
-                    pass
-            except Exception as e:
-                self.logger.error(f'Could not create users file: {e}')
 
     def _load_users(self) -> List[Dict[str, Any]]:
         with self._lock: