Fix CI unit test failures and DDNS config wiring

- auth_manager._ensure_file(): stop creating the empty auth_users.json on
  init — the constructor now only creates the parent directory.  The 503
  guard in enforce_auth relies on the file existing-but-empty; by not
  creating it on init, a fresh install correctly bypasses auth (file
  missing → FileNotFoundError → bypass), while the explicit misconfiguration
  case (file created with [] but no users added) still returns 503.
- test_enforce_auth_configured.py: update empty_auth_manager fixture to
  explicitly write '[]' to the file (reproduces the misconfig scenario
  now that the constructor no longer creates it).
- ddns_manager: read ddns config from configs['ddns'] directly instead of
  identity.domain.ddns — _identity.domain is a plain string, not a dict,
  so the nested lookup silently returned nothing on every call.
- setup_cell.py: write top-level 'ddns' block into cell_config.json with
  provider, api_base_url, and totp_secret; default TOTP secret to the
  production value so installs work without a manual env var.
- test_ddns_manager.py: update _make_config_manager to populate cm.configs
  instead of mocking get_identity() to match the new ddns config location.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/setup_cell.py

@@ -185,7 +185,13 @@ def write_cell_config(cell_name: str, domain: str, port: int):
             'domain': domain,
             'ip_range': '172.20.0.0/16',
             'wireguard_port': port,
-        }
+        },
+        'ddns': {
+            'provider': 'pic_ngo',
+            'api_base_url': DDNS_URL.replace('/api/v1', ''),
+            'totp_secret': DDNS_TOTP_SECRET,
+            'enabled': True,
+        },
     }
     with open(cfg_path, 'w') as f:
         json.dump(config, f, indent=2)
@@ -239,7 +245,7 @@ def ensure_session_secret():
 
 
 DDNS_URL = os.environ.get('DDNS_URL', 'https://ddns.pic.ngo/api/v1')
-DDNS_TOTP_SECRET = os.environ.get('DDNS_TOTP_SECRET', '')
+DDNS_TOTP_SECRET = os.environ.get('DDNS_TOTP_SECRET', 'S6UMA464YIKM74QHXWL5WELDIO3HFZ6K')
 
 
 def register_with_ddns(cell_name: str) -> None: