fix(security): restore loopback-only server defaults in packaged config

server_schema.py was hardened to default host=127.0.0.1 and
cors.origins=["http://localhost:8000"], but default_config.json — the
lowest-precedence base config layer that overrides schema defaults —
still shipped host="0.0.0.0" and cors.origins=["*"], silently defeating
the hardening for every deployment using the packaged defaults.

Align both default_config.json files (packaged + repo sample) with the
secure schema defaults.  Operators binding to 0.0.0.0 for network
exposure must now set host + cors.origins + trusted_hosts explicitly.

Author: fgogolli

config/default_config.json

@@ -211,14 +211,15 @@
   },
   "server": {
     "enabled": false,
-    "host": "0.0.0.0",
+    "host": "127.0.0.1",
     "port": 8000,
     "workers": 1,
     "reload": false,
     "docs_enabled": true,
     "docs_url": "/docs",
     "redoc_url": "/redoc",
     "openapi_url": "/openapi.json",
+    "trusted_hosts": ["localhost", "127.0.0.1", "::1", "testserver"],
     "auth": {
       "enabled": false,
       "strategy": "none",
@@ -231,7 +232,7 @@
     "cors": {
       "enabled": true,
       "origins": [
-        "*"
+        "http://localhost:8000"
       ],
       "methods": [
         "GET",
@@ -275,4 +276,4 @@
       "tag": ""
     }
   }
-}
+}

src/orb/config/default_config.json

@@ -203,14 +203,15 @@
   },
   "server": {
     "enabled": false,
-    "host": "0.0.0.0",
+    "host": "127.0.0.1",
     "port": 8000,
     "workers": 1,
     "reload": false,
     "docs_enabled": true,
     "docs_url": "/docs",
     "redoc_url": "/redoc",
     "openapi_url": "/openapi.json",
+    "trusted_hosts": ["localhost", "127.0.0.1", "::1", "testserver"],
     "auth": {
       "enabled": false,
       "strategy": "none",
@@ -223,7 +224,7 @@
     "cors": {
       "enabled": true,
       "origins": [
-        "*"
+        "http://localhost:8000"
       ],
       "methods": [
         "GET",
@@ -254,7 +255,7 @@
     "recovery_timeout": 60,
     "half_open_max_calls": 3
   },
-"resource": {
+  "resource": {
     "prefixes": {
       "default": "",
       "request": "req-",
@@ -267,4 +268,4 @@
       "tag": ""
     }
   }
-}
+}