If users bind the API to a non-localhost address, the app should warn them. Acceptance criteria: - Detect when host is not `127.0.0.1` or `localhost`. - Show a startup warning. - Document the risk in README.
If users bind the API to a non-localhost address, the app should warn them.
Acceptance criteria:
127.0.0.1orlocalhost.