Accept connections only over loopback

[mattt]

iMCP's listener accepts connections on every IPv4 interface, so another device on the same network can reach it and trigger a connection prompt (#103). Since #229, the CLI connects over 127.0.0.1 using the port from the Bonjour TXT record.

This PR binds both listeners to the IPv4 loopback address. Bonjour still advertises the service and its port on every interface, but connections to a LAN address are refused. The CLI's fallback to the resolved service endpoint, which it uses only when the TXT record has no port, no longer connects.

Closes #103.

[mattt]

Smoke tested with two Macs on the same network:

• On the host, a Debug build of this branch listens on 127.0.0.1:58984 only (lsof -nP -iTCP -sTCP:LISTEN).
• Claude on the same Mac connected through imcp-server over 127.0.0.1, and events_fetch returned today's events.
• From the laptop, dns-sd -B _mcp._tcp local. and dns-sd -L iMCP _mcp._tcp local. still find the service, with port=58984 in its TXT record. nc -vz -G 5 <host address> 58984 gets Connection refused.
• For comparison, a build of main (1.5.3) listens on *:56058, and the same nc from the laptop connects.

Not covered: restartWithRandomPort(), which gets the same change but has no easy manual trigger.