feat: anon and keyless access

[mdgreenwald]

Summary

Adds SOFT_SERVE_ANON_ACCESS / SOFT_SERVE_ALLOW_KEYLESS config and env overrides for the anon-access and allow-keyless settings.

Today those settings are DB-backed and only mutable via an authenticated settings command, so scripting a fully open server from a cold start requires booting with an admin key, waiting for SSH, then running settings as that admin. These overrides let local/dev tooling (e.g. a throwaway Git remote for CI or local scripts) set both at boot with no admin key and no settings call.

• Config takes precedence over the DB value for as long as it's set, matching how initial_admin_keys already behaves (not a one-time seed).
• Startup logs a warning banner if the effective settings grant anonymous keyless connections admin access.
• Running settings anon-access / settings allow-keyless while a config override is active now warns that the DB write has no effect until the override is removed.
• Intended strictly for local/dev bootstrapping, not production.

Issue: #758

Testing

• Unit tests for config parsing/validation and override precedence in the backend.

• New anon-access-env.txtar integration test covering zero-touch bootstrap over SSH/git.

• I have read CONTRIBUTING.md.

• I have created a discussion that was approved by a maintainer (for new features).