Admin API disabled by default (opt-in via --admin-api)

[Copilot]

Summary

The Admin API was on by default — any process on the machine could read/modify server state without explicit opt-in. This flips it to opt-in: pass --admin-api to enable it.

Original Prompt

Issue: Admin API default off

Do not enable the admin api by default

Manual acceptance tests

• Running counterfact api.yaml ./api (no flags) returns 404 for GET /_counterfact/api/health
• Running counterfact api.yaml ./api --admin-api returns 200 for GET /_counterfact/api/health
• The unauthenticated-token warning only appears when --admin-api is passed without --admin-api-token
• counterfact --help shows --admin-api (enable) instead of --no-admin-api (disable)
• Programmatic callers that already set startAdminApi: false explicitly are unaffected

Tasks

• Changed .option("--no-admin-api", ...) → .option("--admin-api", ...) in src/cli/run.ts — Commander now defaults adminApi to undefined (falsy) instead of true
• Updated docs/reference.md CLI reference table: --admin-api with default false
• Added minor changeset (default behavior change)