security: restrict plaintext HTTP to loopback

[RaviTharuma]

Summary

• allow plaintext HTTP only for loopback CLIProxyAPI endpoints
• continue accepting HTTPS for remote hosts
• recognize localhost, all IPv4 127.0.0.0/8 addresses, and IPv6 ::1
• reject remote hostnames and LAN IPs over HTTP, then fall back to the safe localhost default
• add regression coverage for allowed and rejected cases

Security impact

Before this change, a remote http:// base URL received bearer credentials, prompts, responses, and tool payloads without transport encryption or server authentication.

TDD verification

• RED: http://proxy.example/v1 was accepted unchanged
• GREEN: remote HTTP hostname and 192.168.x.x are rejected; loopback forms remain accepted
• full suite with ambient CLIPROXY_API_KEY removed: 30 passed, 0 failed

Closes #5