Add strict ACL startup mode for reference servers

[davidahmann]

Problem

Reference servers can start without explicit ACL configuration, which risks unintended permissive behavior.

Why now

The repo positions these servers as security-conscious references; fail-closed startup on missing ACL config should be enforceable.

Current behavior is insufficient

There is no strict startup mode that consistently blocks launch when required access-control inputs are missing/invalid.

Expected behavior

Add strict mode that fails startup for missing ACL configuration on filesystem/fetch/git servers.

Acceptance / Validation

• Strict mode flag/env blocks startup when ACL config is absent or invalid.
• Deterministic error classification for missing ACL inputs.
• Tests cover strict-mode failure and non-strict behavior.

Evidence packet

• Commit under test: 72efc42 (origin/main)
• Runtime environment: macOS arm64, Node v22.19.0
• Minimal repro:
  1. Start filesystem/fetch/git server with strict mode enabled and no ACL config.
  2. Observe startup behavior.
• Expected: immediate fail-closed startup error.
• Actual: startup can proceed without explicit ACL guard.

Likely codepaths

src/filesystem, src/fetch, src/git.