[codex] Fix Direct IP disabled port validation

[seslly]

Summary

• allows Windrose's stock DirectConnectionServerPort: -1 sentinel when UseDirectConnection is disabled
• continues rejecting -1 when Direct IP is enabled, so enabled Direct IP still requires a real UDP port
• surfaces server-side config staging errors in the admin UI instead of only logging the 400 response
• adds schema coverage for disabled -1, enabled -1, and the existing out-of-range port cases

Why

Issue #10 reports that fresh installs can load a default server config with DirectConnectionServerPort: -1. The admin UI preserved that value when staging unrelated config changes, but the server schema rejected anything outside 1..65535. That made simple edits like changing ServerName fail with HTTP 400 while appearing as a no-op in the UI.

Validation

• python3 tests/test_schema.py
• python3 -m py_compile server.py tests/test_schema.py
• node --check ui/app.js
• pytest -q tests (68 passed)
• git diff --check

Fixes #10.