everything: bind the HTTP transports to loopback by default, with HOST to widen #5371

Problem

The everything server's HTTP transports (Streamable HTTP and the deprecated HTTP+SSE) call app.listen(port) with no host (transports/listen.ts), so they bind to every network interface. A developer who starts the server over HTTP on a laptop exposes its tools to every host on the local network, not just to clients on the same machine. Browser access is already restricted to localhost origins (#5241), but a non-browser client on the LAN sends no Origin header and is let through.

Expected behavior

The HTTP transports bind to the loopback interface (127.0.0.1) by default, and a HOST environment variable (for example HOST=0.0.0.0) widens the bind deliberately, as a container image does (#3309). The README documents the variable and the default.

Reference prototype

#3303 by @TheodorNEngoy binds both HTTP transports to 127.0.0.1 by default with a HOST override (its CORS half has since shipped in #5241). It was opened before this repository moved to issues-only contributions, and is closed in favor of this issue; it serves as the reference prototype for the fix, and its author will be credited when the fix ships.