fix(server): add --host to restrict which interfaces the server binds

[RonenMars]

Fixes #517.

The problem

httpServer.listen(port) was called without a host, which is Node's listen-on-everything default, and there was no flag to narrow it. Every device on the LAN could reach port 8766, with the API key as the only thing stopping them. On a home network that is usually fine; on café Wi-Fi, a co-working space, or a corporate VLAN it is not.

The README also claimed the server listens on http://localhost:8766, which read as loopback-only and was simply wrong.

The change

Adds --host <address> to serve, threaded through ServerConfig.host to the listen call. Default behaviour is unchanged — omitting it still binds all interfaces — so no existing deployment shifts under anyone.

tb-streamer serve --host 127.0.0.1    # loopback only

Docs corrected

Three README passages said or implied the wrong thing:

• "listens on http://localhost:8766" → now states plainly that the default is all interfaces, port 8766.
• The Remote Access section now names the --host 127.0.0.1 escape hatch instead of only describing the exposure.
• The Security section previously ended with "If you need it strictly local today, bind it yourself at the firewall or run it inside a network namespace — the server will not do it for you." That is no longer true, and the sentence is replaced with the flag plus a note that firewalls and namespaces remain the answer for stricter policies.

Verification

tsc --noEmit clean; biome check clean across 378 files.

__tests__/server-bind-retry.test.ts extended to cover the new binding path (+41/−8).

One note for whoever reviews on this branch layout: it lives in a worktree under .worktrees/, and npm run lint there silently checks nothing — biome ignores dot-directories, so biome check . reports "These paths were provided but ignored: ." and exits clean. The checks above were run with explicit paths instead. Anyone verifying this branch in place should do the same rather than trusting a bare npm run lint.