serve: wire Host allowlist through coli CLI

[tasoo-oos]

Summary

PR #606 added --allowed-host and COLI_ALLOWED_HOSTS to openai_server.py, but coli serve and coli web import serve() directly and bypass that parser. The documented primary entry points therefore could not configure the reverse-proxy Host allowlist.

Wire the existing allowlist through both CLI entry points, expose it in their help, and document the flag, environment variable, and reverse-proxy setup.

Validation

• make -C c check
• CUDA changes were tested with make -C c cuda-test (not applicable)
• Performance claims include hardware, commands, and repeatable measurements (not applicable)

Compatibility

• The default CPU build remains dependency-free
• No model files, generated binaries, or benchmark artifacts are included