fix: restrict legacy server entrypoint to loopback

[Justinabox]

Summary

• Restrict the legacy source-tree python server.py compatibility entrypoint to 127.0.0.1 when it starts without API keys.
• Emit a public-safe warning that this mode is unauthenticated and loopback-only, directing remote deployments to callstack serve with API keys.
• Add a mock-only regression test that verifies the startup host, port, absent API keys, and warning without opening hardware or network resources.

Closes #4.

Verification

• PYTHONPATH=. uv run --no-project --with pytest --with pytest-asyncio --with pytest-aiohttp --with pyserial-asyncio --with aiosqlite pytest tests/test_api_auth.py -q — 25 passed
• git diff --check — passed
• PYTHONPATH=. uv run --no-project --with pytest --with pytest-asyncio --with pytest-aiohttp --with pyserial-asyncio --with aiosqlite pytest tests/ -q — 1028 passed

Risk

This affects only the legacy python server.py no-key compatibility path. The packaged callstack serve policy and run_server(...) API are unchanged. Remote use should continue through callstack serve with configured API keys.

[Justinabox]

Release-lane classification: needs-human.

Although the change is small and defensive, it sets the authentication/network exposure policy for the legacy python server.py entrypoint (forced loopback without API keys and a production-use warning). Per this lane's rule against autonomous security/credential-policy decisions, it will not be auto-merged. Please obtain Korgo's explicit approval of the compatibility and operator policy, then request a current-base review with fresh gates.

[Justinabox]

Release-lane classification: needs human decision.

This changes a security-sensitive or externally exposed policy surface. It requires Korgo's explicit product/security decision and a focused security review before an autonomous merge; local test success alone is not authorization to land it.

[Justinabox]

Release classification: needs-human.

This change affects an externally visible security/default-exposure policy. It should not be merged autonomously without Korgo’s explicit decision on the intended compatibility and threat-model behavior. Please retain as a draft pending that decision; any follow-up must be rebased on current main and revalidated with the prescribed full suite.

[Justinabox]

Release review: needs-human. Restricting the legacy server entrypoint to loopback changes network exposure and deployment behavior. This security/deployment policy requires Korgo approval before merge.

[Justinabox]

Release classification: needs-human decision.

This changes externally reachable server binding behavior. The scheduled lane will not make network-exposure/default-binding policy decisions. Please confirm the intended deployment compatibility and secure-default policy before a dedicated security/release review.