Adding a PC whose own Ovis is bound to a non-loopback HOST fails with a raw ECONNRESET #1960

What happens

Adding a PC (Settings → Remote PCs, POST /api/machines/setup) fails with a raw fetch error when that PC already runs its own Ovis bound to a non-loopback address (for example HOST=<its Tailscale address>, as docs suggest for a preview):

failed  Connection failed  error=ECONNRESET: The socket connection was closed unexpectedly. For more information, pass `verbose: true` in the second argument to fetch()

The server log only has {"event":"machine.remote.failed","operation":"bridge","code":"connection_lost",...}.

Why

The setup finds the remote Ovis's bridge descriptor (~/.config/ovis/bridges/*.json, port 18472 here) and verifies it through ssh -L 127.0.0.1:<free>:127.0.0.1:<descriptor port> (server/ssh.ts forward, called from verify in server/machines.ts). A server bound to another address does not listen on the remote's 127.0.0.1, so the tunnel's connection is reset and fetch(.../api/bridge) throws.

Reproduction (v0.4.17, decc449)

1. PC B: fresh curl -fsSL https://ovis.sh/install.sh | sh, plugin env HOST=<non-loopback address>, PORT=18472, herdr server running.
2. PC A (0.4.17): add PC B over SSH (tester@127.0.0.1, port 2272 in my test; trust the fingerprint).
3. The job ends failed with the ECONNRESET text above.
4. Set B's HOST=127.0.0.1, restart B's Ovis, add again: connected at once.

Seen in the upgrade-check-0417 QA (two Ubuntu 24.04 containers on one host, SSH between them). Not a regression check of this release; found while setting up a second PC.

Expected

Either reach the descriptor's own address, or fail with a message that says the PC's Ovis listens on another address than 127.0.0.1 and what to change.