fix(security): enforce loopback in local mode

[ttbombadil]

Summary

• Restrict local-mode listeners to numeric loopback addresses by default.
• Require UNOSIM_UNSAFE_ALLOW_EXTERNAL_LOCAL_BIND=true before any external local-mode bind.
• Document the unsafe opt-in and add coverage for loopback, external hosts, and explicit opt-in.

Verification

• RED: config test failed because 0.0.0.0 was accepted without an opt-in.
• GREEN: npm run test:unit (2,744 passed, 1 skipped), npm run check, npm run check:docs.