Feature Request: Allow configurable HOST/IP binding

[mjfork]

Description

Currently, the server binds to 0.0.0.0 (all interfaces) with no way to configure this. This can be a security concern in some environments where users want to restrict the server to only listen on localhost (127.0.0.1) or a specific network interface.

Proposed Solution

Add a HOST environment variable that allows users to specify which host/IP address the server should bind to:

• Default: 0.0.0.0 (all interfaces - maintains backward compatibility)
• Example: HOST=127.0.0.1 (localhost only for enhanced security)
• Example: HOST=192.168.1.100 (specific network interface)

Changes Required

1. Add HOST environment variable to .env.example with documentation
2. Update server/index.js to use HOST env var instead of hardcoded '0.0.0.0'
3. Update vite.config.js to use HOST env var for the Vite dev server

Use Cases

• Security-conscious deployments that should only be accessible locally
• Multi-homed servers where the application should only be available on a specific network
• Development environments where binding to all interfaces is not desired

---

🤖 Generated with Claude Code

[viper151]

Thank you for raising this issue and the fix.

The Express server requires authentication for all sensitive endpoints, so network exposure doesn't create immediate risk. However, we agree that defense-in-depth is good practice.
Vite on the other hand should default to localhost.

We'll review the PR soon