stabbur 0.11.1

Five things a headless Linux box found in 0.11.0, all fixed. If you run stabbur on a
Mac with the wizard, most of this is invisible to you; if you deploy it over SSH to a
Linux server fronting a llama-server router, all of it is for you.

serve_ui = true in stabbur.toml served the browser UI and never said so: the banner
printed the UI line only for the --ui flag. On a non-loopback bind that mattered more
than a missing line, because the tokenized URL the banner withholds is the one thing
that makes the first visit work. The page itself is not gated, so the shell loaded and
every call behind it answered 401, which looks like a broken app rather than a missing
credential. The banner now follows what is actually served.

stabbur init reported tools: none and wrote no .mcp.json, and an absent file means
"use the machine's global tools". So the project ran with tools its manifest never
mentioned, and behaved differently on every machine it was copied to. A scaffold now
always writes the file, empty when nothing was picked, and tools: none is true. An
existing project with no .mcp.json still falls back to the global set as before; the
example manifest now says so.

A project that binds no model is a supported state: serve runs free-play with the
picker. But the only non-interactive path produced a locked project, so provisioning an
unlocked one over SSH meant scaffolding it locked and hand-editing the model line out.
--no-model is the scriptable form of the wizard's "No model yet". The manifest now
leaves the model key out (commented) instead of writing model = "", and the loader
reads an empty model as unbound. That also fixes a latent bug: a wizard-made no-model
project handed serve a locked model named "".

On Linux, five of the six voice models are backed by mlx-audio, which is Apple Silicon
only, and stabbur voice list offered all six alike and invited pulling any of them.
Those rows are now dimmed and annotated, with a footnote naming the platform.
stabbur library pull voice <id> warns before downloading one; it still pulls, because a
library drive can legitimately move to a Mac. The practical consequence, now in the
voice guide as well: on Linux, text to speech works and speech to text does not, so the
chat composer's dictation mic cannot function there.

TOML binds a bare key to the table above it, so port = 8888 typed after [project]
parses cleanly as project.port, reaches nothing, and the server keeps binding 2222
while the file plainly says otherwise. The loader now warns about any key inside
[project] or [voice] that stabbur never reads there, and names the fix when the key
is a known top-level setting.

Serving a "token required" page instead of the bare UI when a token is set and the
request carries none. That is a separate design change and stays open.