fix(codemode): bound refresh and prefer loopback daemon

[jmagar]

Summary

Fixes two production Code Mode resilience issues discovered after #699:

• same-host CLI discovery could prefer Labby's configured non-loopback/Tailscale bind address, triggering DNS-rebinding Host validation and forcing local fallback;
• long-lived MCP Code Mode catalog refresh could spend the entire execution deadline waiting on unhealthy upstreams.

Changes

• Opportunistic CLI discovery now probes loopback first, then configured/public fallback addresses. Explicit operator/plugin targets remain authoritative and Host validation is unchanged.
• Long-lived MCP catalog refresh now uses the same half-timeout_ms wall-clock budget as one-shot CLI catalog refresh.
• If the refresh budget expires and at least one real upstream is already usable, Code Mode serves the partial healthy catalog and logs the degradation.
• If no real upstream is usable when the budget expires, Code Mode still fails closed with upstream_connect_error.
• Gateway docs updated to describe both contracts.

Verification

Pinned Rust 1.97.1:

• cargo check -p labby-gateway -p labby: pass
• cargo clippy -p labby-gateway -p labby --all-targets: pass
• live_gateway::tests::*: 44 passed, 0 failed
• MCP partial-catalog refresh-budget regression: pass (~1.01s)
• MCP no-real-upstream fail-closed regression: pass (~1.01s)
• Full gateway Code Mode suite: 67/68; sole failure is the existing concurrent tracing-capture flake one_shot_cli_catalog_bounds_cold_connects_and_persists_completed_upstreams, which passes in isolation
• cargo fmt / git diff --check: pass

Security note: this does not loosen Host validation or permit silent builtin-only fallback.