Restore explicit non-loopback bind opt-in

[johnnygreco]

Summary

Adds an explicit [server] allow_non_loopback = true opt-in so Beacon can bind to trusted private-network interfaces such as 0.0.0.0:4600 for direct Tailscale-IP dashboard access. The default remains loopback-only, and validation still rejects non-loopback hosts unless the opt-in is set.

Closes #317
Refs #316

Validation

• format: make fmt-check -> passed
• generated files: make generate-check -> passed, updates=0
• focused tests: go test ./internal/config ./internal/beaconcli -> passed
• broad tests: make test -> passed
• lint: make lint -> passed
• local install: make install-local INSTALL_DIR="$HOME/.local/bin" -> passed
• whitespace: git diff --check -> passed

Risks

The security-sensitive behavior is the non-loopback bind path. The PR keeps the default at 127.0.0.1, requires an explicit opt-in for non-loopback hosts, and documents that anyone who can reach the bound interface can inspect Beacon dashboard/API/MCP data.

Reviewer Notes

Focus on whether the opt-in is explicit enough, whether default validation remains restrictive, and whether the docs clearly distinguish proxy/VPN access from direct private-network binding. Backward compatibility was not generally required; the explicit user requirement is restoring direct Tailnet-IP access through a deliberate modern config path.

[johnnygreco]

Review Record

Frozen target: main 841898441533a693ff3fbae6ead94234beeac1f3..fix/317-non-loopback-bind 4835447d56ab2c53ca063c15ac6fa78f9869b2a5
Diff command: git diff 841898441533a693ff3fbae6ead94234beeac1f3..4835447d56ab2c53ca063c15ac6fa78f9869b2a5

Panel:

• Loopback Sentinel: robustness/correctness, config load/validation semantics, serve-start ordering -> clean
• Harbor: security/privacy, integration/operations -> findings
• Northstar: tests/coverage, documentation/adoption, maintainability/complexity, config UX/error text -> findings
• Loopback Probe Rerun: tests/coverage, diagnostics UX, maintainability/complexity, health probing correctness -> clean
• Loopback Boundary Rerun: security/privacy, integration/operations, documentation/adoption -> clean
  Skipped Review-Standard lenses: none

Accepted findings fixed:

• beacon status, doctor setup, and down probed only 127.0.0.1; fixed by probing the configured server host and normalizing wildcard binds to loopback for local health checks.
• Direct-bind docs used 0.0.0.0 as the main example and under-described exposure; fixed by preferring a specific Tailnet/private IP and explicitly warning about wildcard IPv4 binding and API/MCP mutation paths.

Rejected findings:

• none

Validation after fixes:

• make fmt-check -> passed
• make generate-check -> passed, updates=0
• go test ./internal/config ./internal/beaconcli -> passed
• make test -> passed
• make lint -> passed
• make install-local INSTALL_DIR="$HOME/.local/bin" -> passed
• git diff --check -> passed
• GitHub CI on 4835447d56ab2c53ca063c15ac6fa78f9869b2a5 -> all checks passed: build, dependency-review, format, frontend, generated, govulncheck, lint, npm-audit, playwright-accessibility, playwright-dashboard, test

Final status: all rerun reviewers clean; no unresolved blockers