A worker joined to a gateway does not serve its own HTTP API or console #705

Problem

A worker joined to a gateway can still turn on its own HTTP API and web console. The gateway is meant to be the one contact point for a fleet: its console shows every worker, and from #701 on it is where people sign in through a sign-in proxy. A joined worker's own console and API are a second door into the same machine, with their own tokens, that the fleet's operator may not know is open.

Proposed: in mode: "worker" with gateway.url set, http.enabled: true is refused at load, naming the key, the way mode: "gateway" with http.enabled: false is today. Local agents keep the unix socket; agent-device and stream traffic already go over the uplink. This is a breaking config change for anyone running a joined worker with HTTP on.

Context

Split out of #701, which deliberately leaves it alone.

Written by an agent.