QUIC renderer bind silently widens to 0.0.0.0 on listen_addr parse failure with no log

[forkwright]

Finding

When forming the QUIC renderer listen address, a parse failure silently falls back to 0.0.0.0:4433 with no log. format!("{}:{}", config.paroche.listen_addr, DEFAULT_QUIC_PORT).parse() produces an unparseable string for an IPv6 listen_addr such as "::" (yielding ":::4433"), and the unwrap_or_else fallback hard-codes an IPv4 wildcard.

Evidence

crates/archon/src/serve.rs:719:

.unwrap_or_else(|_| {

Lines 719-721 construct the fallback from [0, 0, 0, 0] with no tracing::warn!/tracing::error! and no error propagation.

Why this matters

An operator who sets listen_addr = "::" to bind only IPv6 silently gets an IPv4 wildcard QUIC listener on all interfaces, contradicting the configured bind and potentially exposing port 4433 on interfaces the operator meant to exclude. Because the HTTP server binds :::8080 correctly, the QUIC mismatch is invisible without a port scan — a silent attack-surface widening on a device whose threat model assumes network adversaries.

Desired correction

Construct the SocketAddr directly from the parsed listen_addr IP plus DEFAULT_QUIC_PORT rather than round-tripping through a format string. If a parse failure can still occur, log tracing::error! and abort startup instead of silently widening the bind.
Done when: an IPv6 listen_addr yields either a correct [::]:4433 bind or a startup error, and never a silent 0.0.0.0 fallback.