Validate loopback proxy hosts as IP literals

The loopback-only proxy guard should not treat arbitrary DNS names that start with 127. as loopback. Validate hostnames with node:net isIP before accepting the 127.0.0.0/8 range, while continuing to support localhost and IPv6 loopback.\n\nValidation: npm run check; npm test -- src/lib/icons.test.ts src/lib/stores/starred.test.ts; npm run build; npm ci --dry-run; git diff --check; verified proxy rewrites 127.0.0.1 but preserves LAN, foreign, empty, and 127.example.test-style origins.

Generated with Codex
Co-authored-by: Codex <noreply@openai.com>

Author: mariusvniekerk

frontend/vite.config.ts

@@ -1,4 +1,5 @@
 import { execSync } from "node:child_process";
+import { isIP } from "node:net";
 import { defineConfig } from "vite";
 import { svelte } from "@sveltejs/vite-plugin-svelte";
 
@@ -17,10 +18,12 @@ const apiTargetOrigin = new URL(apiTarget).origin;
 
 function isLoopbackHostname(hostname: string): boolean {
   const lower = hostname.toLowerCase();
+  const unbracketed = lower.startsWith("[") && lower.endsWith("]")
+    ? lower.slice(1, -1)
+    : lower;
   return lower === "localhost" ||
-    lower === "127.0.0.1" ||
-    lower.startsWith("127.") ||
-    lower === "[::1]";
+    (isIP(unbracketed) === 4 && unbracketed.split(".")[0] === "127") ||
+    unbracketed === "::1";
 }
 
 function requestOriginMatchesLoopbackDevServer(