P1: Add test asserting HTTP default bind is 127.0.0.1

[heidi-dang]

Add automated test(s) ensuring default HTTP bind is localhost-only.

Acceptance:

• Unit-level test preferred (no real network)
• Asserts default host is 127.0.0.1 for default entrypoint
• If insecure bind exists, test ensures explicit opt-in + warning.