#6590: Harden Debug UI defaults: loopback-only binding + warnings

This PR adds guardrails to the Control/Debug UI to reduce accidental exposure. Changes: - Default binding changed to 127.0.0.1 (loopback) - Non-local requests are warned by default - Optional strict mode rejects non-local requests with HTTP 403 (`strictLoopback`) - Logs use the subsystem logger for warnings - Documentation updated to clarify local-only usage - Tests included for default and strict modes Related issue: #2245 --- Hi @steipete, This PR hardens the Debug/Control UI defaults to prevent accidental exposure. All tests pass and documentation is updated. Let me know if any adjustments are needed — happy to iterate! All changes are scoped to the Control UI. Default behavior is non-breaking; strict mode is opt-in. <!-- greptile_comment --> <h2>Greptile Overview</h2> <h3>Greptile Summary</h3> This PR introduces a new loopback-guard middleware for the Control UI, updates the gateway HTTP handler to invoke it, adds startup warnings when binding the Control UI to non-loopback addresses, and documents the intended local-only posture plus an opt-in strict 403 mode. The main issues are around wiring and scope: `strictLoopback` is documented and plumbed into `createGatewayHttpServer`, but it isn’t actually read from config/opts or passed from runtime state creation, so strict mode won’t activate. Additionally, the guard is currently executed for all HTTP requests whenever `controlUiEnabled` is true (before any Control UI path matching), which can generate misleading warnings and, in strict mode, incorrectly block non-Control-UI endpoints. <h3>Confidence Score: 2/5</h3> - This PR has meaningful behavioral issues that should be addressed before merging. - While the hardening intent is good, strict mode is currently not wired from config/runtime into the server, and the loopback guard is applied too broadly (can warn/block non-Control-UI endpoints). These are likely to cause confusion and, if strict mode is later enabled, real breakage. - src/gateway/server-http.ts, src/gateway/server-runtime-state.ts, src/gateway/server-runtime-config.ts, src/gateway/server-startup-log.ts <!-- greptile_other_comments_section --> _{(2/5) Greptile learns from your feedback when you react with thumbs up/down!} <!-- /greptile_comment -->