[bug] Guard(config=) / TOML silently drop mode=server and strict_scanner_allowlist #85

Problem

Constructing Guard(config=...) or loading TOML can silently drop mode=server and strict_scanner_allowlist. Callers believe they enabled server mode or a strict allowlist, but local defaults apply instead.

Expected / acceptance criteria

• mode override applies only when explicitly set (and is not dropped on config merge)
• Config loader parses strict_scanner_allowlist (or documented equivalent) and wires it through
• Regression: TOML / GuardConfig with these fields produces the expected Guard behavior (server client or allowlist enforcement)