Harden credential storage and server exposure

[marceli1404]

What changed

• stop persisting the OpenCode password in localStorage and purge legacy stored values
• keep credentials in memory only; reloads require password re-entry
• stop printing the password in the server manager
• bind the OpenCode server to 127.0.0.1 by default and honor OPENCODE_HOSTNAME
• warn when intentionally binding beyond loopback
• remove automatic curl | bash installation; OpenCode must be installed explicitly
• replace the shell-based readiness probe with Node HTTP
• update .env.example and README security guidance

Verification

I re-read the changed files on this branch and confirmed there is no remaining localStorage.setItem('opencode-password', ...), raw password printing, automatic curl | bash installer, or all-interface default bind in the edited paths.