[utpalsinghdev]

Summary

SSH detection currently enables remote mode and binds the review server to
0.0.0.0. This makes unauthenticated endpoints reachable from the network,
even when the user only needs SSH port forwarding.

This PR keeps SSH-detected sessions on 127.0.0.1 in both the Bun server and
the Pi extension. They retain the fixed remote port, browser-opening behavior,
and existing remote feature restrictions.

Binding all interfaces now requires explicit PLANNOTATOR_REMOTE=1 or true.
Explicit remote mode and the Bun CLI's --tailscale publishing remain unchanged.

The patch also:

• Warns when an SSH-loopback session advertises a nonlocal hostname that needs
  forwarding or a proxy, while preserving public reverse-proxy URLs.
• Updates SSH setup instructions to leave PLANNOTATOR_REMOTE unset instead
  of opting users back into all-interface binding.

How this relates to #956

The issue reports several separate security gaps. Two already have fixes on
main:

• DNS rebinding and hostile Host headers: Validate the Host header on every request (defense in depth) #1742 added server-wide Host
  validation across both runtimes.
• Browser CSRF against state-changing endpoints: harden state-changing routes: same-origin + session guards #1921 added a global
  same-origin guard before routing, covering approval, feedback, agent jobs,
  and Ask AI endpoints.
• Automatic network exposure over SSH: this PR prevents SSH environment
  variables alone from exposing the server beyond loopback.

General endpoint authentication remains unresolved. With explicit remote mode
enabled, network clients that can reach the server can still call sensitive
endpoints without a session token. Host and Origin checks are not authentication
for non-browser clients.

Related to #956. This is a partial mitigation, not a complete resolution.

Verification

• 246 targeted tests passed across network configuration, advertised URLs,
  Host/Origin guards, state-changing routes, and Tailscale Serve orchestration.
• Typechecks passed for packages/shared, packages/server, and
  apps/pi-extension.
• Real Brave browser verification reached successful plan approval in both
  runtimes under SSH detection.
• Actual listeners bound only to 127.0.0.1. Loopback requests succeeded;
  same-machine connection attempts through the LAN and Tailscale addresses
  were refused.
• Foreign-Origin text/plain approval requests returned HTTP 403 in both
  runtimes.
• git diff --check passed.