feat(ui): add configurable host binding

[Blamp26]

What does this PR do?

Adds a persisted --host=<IPv4> option for the embedded Graph UI.

The default remains 127.0.0.1, preserving the existing localhost-only security posture and backward compatibility with older config files.

Supported examples:

codebase-memory-mcp --ui=true --host=127.0.0.1 --port=9749
codebase-memory-mcp --ui=true --host=192.168.88.26 --port=9749
codebase-memory-mcp --ui=true --host=0.0.0.0 --port=9749

The implementation:

• accepts numeric IPv4 addresses only;
• rejects empty, malformed, and hostname values with exit status 2;
• persists ui_host alongside the existing UI settings;
• passes the configured host through the HTTP server/listener APIs;
• preserves port 0 support for tests;
• emits a prominent warning for non-loopback bindings;
• identifies 0.0.0.0 as all interfaces;
• keeps the existing CORS policy unchanged;
• updates documentation and the UI security audit.

Fixes #229

Security

Non-loopback binding remains an explicit opt-in.

The warning explains that the UI:

• has no authentication;
• is reachable over the network;
• may expose codebase graph data and UI actions;
• should be protected with a firewall or trusted network.

The documentation recommends binding a specific LAN address instead of 0.0.0.0.

Validation

• Every commit is signed off
• make -f Makefile.cbm test — 6,012 passed, 1 platform-specific skip
• make -f Makefile.cbm lint-ci CPPCHECK=/opt/cppcheck/bin/cppcheck CLANG_FORMAT=clang-format-20
• scripts/security-ui.sh
• make -j$(nproc) -f Makefile.cbm cbm
• make -j$(nproc) -f Makefile.cbm cbm-with-ui
• Focused UI/HTTP tests — 64 passed, 1 platform-specific skip
• New behavior is covered by tests
• Default 127.0.0.1 binding tested manually
• 0.0.0.0 binding and warning tested manually
• Specific 192.168.88.26 binding tested manually
• Persisted host reuse tested manually
• Invalid and empty host rejection tested manually

Portability note

Windows runtime testing was not available locally. The Windows Winsock and AF_INET paths compile through the project code, with additional Windows validation left to the repository CI matrix.

[DeusData]

Thanks for making loopback the default and documenting the unauthenticated exposure risk. This is a security-sensitive 0.9.2-rc backlog enhancement. A non-loopback listener expands the product boundary even when explicitly configured, so merge is gated on a maintainer product-security decision. Any acceptable version must retain 127.0.0.1 as the default, require explicit opt-in, preserve strict CORS, and clearly warn that no authentication exists.