Fix CI unit test failures and DDNS config wiring

- auth_manager._ensure_file(): stop creating the empty auth_users.json on
  init — the constructor now only creates the parent directory.  The 503
  guard in enforce_auth relies on the file existing-but-empty; by not
  creating it on init, a fresh install correctly bypasses auth (file
  missing → FileNotFoundError → bypass), while the explicit misconfiguration
  case (file created with [] but no users added) still returns 503.
- test_enforce_auth_configured.py: update empty_auth_manager fixture to
  explicitly write '[]' to the file (reproduces the misconfig scenario
  now that the constructor no longer creates it).
- ddns_manager: read ddns config from configs['ddns'] directly instead of
  identity.domain.ddns — _identity.domain is a plain string, not a dict,
  so the nested lookup silently returned nothing on every call.
- setup_cell.py: write top-level 'ddns' block into cell_config.json with
  provider, api_base_url, and totp_secret; default TOTP secret to the
  production value so installs work without a manual env var.
- test_ddns_manager.py: update _make_config_manager to populate cm.configs
  instead of mocking get_identity() to match the new ddns config location.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_enforce_auth_configured.py

@@ -53,8 +53,11 @@ def empty_auth_manager(tmp_path):
     os.makedirs(data_dir, exist_ok=True)
     os.makedirs(config_dir, exist_ok=True)
     mgr = AuthManager(data_dir=data_dir, config_dir=config_dir)
-    # The constructor creates the file with '[]' (empty list). We do NOT add
-    # any user, so list_users() returns [] but the file is readable.
+    # Explicitly create the file with an empty list to simulate the
+    # "auth configured but no users" misconfiguration scenario.
+    users_file = os.path.join(data_dir, 'auth_users.json')
+    with open(users_file, 'w') as f:
+        f.write('[]')
     assert mgr.list_users() == [], 'Expected empty user list'
     return mgr