Ship loopback-safe scoped consent matching for Standalone. This release keeps Local/Cloud scoped consent strict while accepting same-port localhost and 127.0.0.1 aliases for the same local xpod.

Constraint: LinX consumes published xpod packages from npm via git tag release automation.
Rejected: Loosen all storage-provider URL matching | would risk Cloud Pod leakage in Local flows.
Confidence: high
Scope-risk: narrow
Directive: Only treat loopback aliases as equivalent when protocol and port match.
Tested: bunx vitest --run tests/identity/ScopedPickWebIdHandler.test.ts tests/provision/ProvisionPodCreator.test.ts tests/runtime/bootstrap.test.ts
Tested: bun run build:ts && bun run build:components
Not-tested: Full LinX e2e against v0.3.40 before npm publish