fix(app)!: unify startup policy and listener selection

[Kilerd]

Builder run() ignored config.server, and automatic configuration errors silently fell back to defaults while GotchaApp::run() returned errors. Both APIs now use one internal startup pipeline and a strict default configuration policy.

Listener selection follows listen / listen_on > per-field .host() / .port() overrides > config.server > framework defaults. Explicit default values remain overrides. For example, a configured port of 8080 is now honored by builder run(), while .port(3000) still selects 3000.

• Add ConfigErrorPolicy to both APIs, with an explicit fallback factory and fallback_to_default() convenience method. Only selecting the default fallback requires C: Default.
• Share configuration loading, address resolution, binding, state/router initialization, task registration, and serving through private adapters. Bind failures happen before state or tasks start; later initialization errors release the listener.
• Put the effective bound address into the context before state initialization, including the actual port assigned for port 0. Accept IPv4 and IPv6 address literals.
• Document the changed builder defaults and initialization order in README and MIGRATION. Task cancellation and shutdown ownership remain tracked in [P2][task] 让应用运行实例持有后台任务并负责取消与退出等待 #93.

Validation passed locally: cargo check --workspace --all-features, cargo test -p gotcha, cargo test -p gotcha --all-features, cargo clippy --all-features --workspace -- -D warnings, and formatting/diff checks. Tests cover address precedence once at the resolver, actual HTTP responses through both adapters, strict and explicit fallback policies, public run() bind failures, and listener release after initialization errors. Existing tests retain source ordering and runtime types without serde/Default requirements.

All 11 GitHub CI checks passed for 07cff9594aabc55cb80595150c714133d1c30d36.

Closes #92