fix(web): default to loopback binding

packages/host/webserver/src/index.ts

@@ -21,7 +21,9 @@ export type {
 
 /** Options for startWebServer. */
 export interface WebServerOptions {
-  /** Port to listen on (0.0.0.0). */
+  /** Address or hostname to listen on. */
+  host: string
+  /** Port to listen on. */
   port: number
   /**
    * Absolute path of index.html inside the static root — the caller resolves
@@ -50,7 +52,7 @@ export interface RunningWebServer {
 }
 
 /**
- * Start the web-shape HTTP server: listen(port, '0.0.0.0').
+ * Start the web-shape HTTP server on the caller-selected host and port.
  * Routing: /api/* → apiHandler bridge; non-GET/HEAD → 405; everything else →
  * static with the step1-locked semantics (403 traversal, SPA fallback 200).
  * A listen failure (EADDRINUSE…) rejects — the shell decides how to exit; a
@@ -63,7 +65,7 @@ export interface RunningWebServer {
  * @returns the running server handle once listening.
  */
 export function startWebServer(options: WebServerOptions, onError: (err: Error) => void): Promise<RunningWebServer> {
-  const { port, distIndex, apiHandler, webPlugins } = options
+  const { host, port, distIndex, apiHandler, webPlugins } = options
   const distRoot = dirname(distIndex)
   const renderIndex = webPlugins === undefined ? undefined : async (): Promise<string> => {
     const html = await readFile(distIndex, 'utf8')
@@ -113,7 +115,7 @@ export function startWebServer(options: WebServerOptions, onError: (err: Error)
 
   return new Promise((resolveListen, rejectListen) => {
     server.once('error', rejectListen)
-    server.listen(port, '0.0.0.0', () => {
+    server.listen(port, host, () => {
       server.off('error', rejectListen)
       server.on('error', onError)
       resolveListen({ port, close })