fix(opencode): centralize unsecured server warning

[shafdev]

Issue for this PR

Closes #22122

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

This fixes inconsistent unsecured-server warning behavior when OPENCODE_SERVER_PASSWORD is unset.

Before this change, warning output was handled in serve and web command handlers, so other startup paths (like acp) could start an unsecured server without showing the warning.

I moved the warning to the shared server startup path (Server.listen) and removed duplicated warning logic from serve and web.
This makes behavior consistent for all commands that start the server.

Files changed:

• packages/opencode/src/server/server.ts
• packages/opencode/src/cli/cmd/serve.ts
• packages/opencode/src/cli/cmd/web.ts

How did you verify your code works?

• bun run --cwd packages/opencode typecheck
• bun run --cwd packages/opencode test
• Manual verification:
  1. unset OPENCODE_SERVER_PASSWORD
  2. bun dev serve -> warning shown
  3. bun dev acp -> warning shown

Screenshots / recordings

N/A (non-UI change)

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR