Reject nonlocal dashboard requests

[Deicyde]

Summary

• require exactly one Host header matching the dashboard's literal loopback listener and bound port
• reject cross-origin browser requests unless their HTTP Origin matches that same listener
• apply the guard before loading claims or serving static files for both GET and HEAD
• test DNS-rebinding Host values on both surfaces and hostile Origins on both request methods

Binding to 127.0.0.1 does not prevent DNS rebinding: before this change, a request with Host: attacker.example received the private static site and live claim JSON with HTTP 200. The request-level authority check closes that boundary while preserving direct 127.0.0.1 and localhost use.

The HEAD guard matters because SimpleHTTPRequestHandler implements it separately from GET; guarding only do_GET left static metadata available to a nonlocal authority.

Validation

At exact head 59e52996:

• full dashboard suite: 14 passed
• make lint: pass
• make check-example: pass
• exact-head GitHub Python 3.10/3.13, Windows, real Lean, and CLA: all pass

#137 has landed the former README baseline fix.

Fixes F29 from #92's adversarial review.

[Deicyde]

Exact-head review is complete at eefe1597. Host and Origin authority are checked before both GET and HEAD response surfaces, including static content and the live endpoint. The full dashboard suite passes (14 tests), as do lint, the executable example, Python 3.10, Windows, both real-Lean runs, and CLA. The duplicate cancelled jobs are runner shutdowns, and the other Python failure is current main's stale README assertion fixed by #96/#137. No feature-code blocker remains.

[Deicyde]

The refreshed exact head 59e52996 is fully green: Python 3.10/3.13, Windows, real Lean, and CLA all pass. It is mergeable and has no known code or ordering blocker.