feat(server): start the bundled WebUI without a model

[inureyes]

Parent / dependencies

Parent: #1834. Depends on #1835, #1836, #1837. Coordinate security integration before enabling non-test access.

Ownership

Own src/cli/ui_compat_args.rs and tests, the argument/plumbing portions of src/main.rs, src/bin/mlx_server.rs, src/commands/serve.rs, src/server/cli_input.rs, config.rs, startup.rs, and top-level app/router mounting. Other backend children expose constructors/helpers instead of independently editing these central files.

Required behavior

• Replace the existing intentional WebUI rejection with one shared resolved mode and UI configuration. Canonical user command is mlxcel-server --webui; mlxcel serve --webui is equivalent. Test --ui, both disabling aliases, LLAMA_ARG_UI, CLI precedence, repeated flags and UI-not-compiled error. Do not repurpose unrelated UI-config/static-path/tools flags.
• No model argument with UI enabled enters the existing RouterPool control plane using cache and optional explicit models directory/presets, even if none is present. Refactor the model-required guards on BOTH entry paths; merely skipping resolve_model_source in one binary is insufficient. Distinguish no startup model from an invalid empty user-supplied source.
• Default empty store produces a healthy empty catalog without creating directories or making network calls; explicit inaccessible roots fail clearly. No tokenizer, provider, MLX model load, warmup or checkpoint fetch on ordinary empty startup. Respect explicit preset preload with clear logging; fix preset-only mode selection consistently.
• With explicit -m preserve single-model mode and show unavailable lifecycle/library mutations with reasons. Preserve existing --models-dir/-m conflict and store-root meaning. Existing API-only behavior, distributed node startup and feature flags do not change.
• Serve at {api_prefix}/webui/ through both app builders. Print canonical listener URL after a successful bind, including IPv6/TLS/prefix; do not launch a browser or expose a credential in the URL. Reject UI with UNIX-socket-only listeners clearly. UI observations use autoload=false and never load a model indirectly.

Acceptance criteria

• Table-driven parsing/startup tests cover both binaries, source/env combinations, empty/missing/default versus invalid explicit roots, presets, single-model/router mode, TLS/prefix and UI-off.
• Test fake loader/network counters remain zero through startup, login, catalog, health, status and UI reload in empty mode. An integration test starts each executable without -m and fetches the bundled shell.
• Startup/flag parity tests and compatibility manifest classify implemented aliases and remaining rejections; no hidden accepted no-op for an enabling feature.
• Route/auth inventory explicitly includes UI routes and validates no root/API collision or duplicate middleware.