Keep loopback proxy host validation self-contained

Avoid relying on prefix checks or additional Node imports for the Vite dev proxy guard. Parse dotted IPv4 literals directly before accepting 127.0.0.0/8, so DNS names such as 127.example.test are not treated as loopback.\n\nValidation: npm run check; npm test -- src/lib/icons.test.ts src/lib/stores/starred.test.ts; npm run build; npm ci --dry-run; git diff --check; verified proxy rewrites 127.0.0.1 but preserves LAN, foreign, empty, and 127.example.test-style origins.

Generated with Codex
Co-authored-by: Codex <noreply@openai.com>

Author: mariusvniekerk

frontend/vite.config.ts

@@ -1,5 +1,4 @@
 import { execSync } from "node:child_process";
-import { isIP } from "node:net";
 import { defineConfig } from "vite";
 import { svelte } from "@sveltejs/vite-plugin-svelte";
 
@@ -16,13 +15,23 @@ function gitCommit(): string {
 const apiTarget = process.env.VITE_API_TARGET ?? "http://127.0.0.1:8080";
 const apiTargetOrigin = new URL(apiTarget).origin;
 
+function isIPv4LoopbackLiteral(hostname: string): boolean {
+  const parts = hostname.split(".");
+  if (parts.length !== 4 || parts[0] !== "127") return false;
+  return parts.every((part) => {
+    if (!/^\d+$/.test(part)) return false;
+    const value = Number(part);
+    return value >= 0 && value <= 255;
+  });
+}
+
 function isLoopbackHostname(hostname: string): boolean {
   const lower = hostname.toLowerCase();
   const unbracketed = lower.startsWith("[") && lower.endsWith("]")
     ? lower.slice(1, -1)
     : lower;
   return lower === "localhost" ||
-    (isIP(unbracketed) === 4 && unbracketed.split(".")[0] === "127") ||
+    isIPv4LoopbackLiteral(unbracketed) ||
     unbracketed === "::1";
 }