Bind serve to loopback and reject non-local WebSocket origins

[paulsmith]

Summary

Bind vibium serve to loopback by default and reject non-local WebSocket origins.

Root Cause

The proxy server printed a ws://localhost:... endpoint, but clicker/internal/api/server.go actually listened on :port, which exposed the server on every interface. The same server also accepted every WebSocket origin via CheckOrigin, so any reachable browser page could attach if the port was accessible.

What Changed

• default the WebSocket server host to 127.0.0.1
• route Start() through the loopback listen address instead of all interfaces
• reject non-local Origin headers while still allowing clients that send no Origin
• add regression tests for loopback binding and cross-origin rejection

Impact

This keeps serve aligned with its local-only contract and closes an avoidable remote-control surface for browser automation.

Validation

• cd clicker && GOCACHE=/private/tmp/vibium-go-build-cache go test ./internal/api

Notes

• go test ./... still fails for a pre-existing repository issue: clicker/cmd/clicker/skill.go embeds a missing SKILL.md.