fix: remove implicit loopback injection, warn if UI enabled without lo

Instead of silently prepending 127.0.0.1 to Listens, the config is now
explicit: bind must include "lo" (or "all") when the UI is enabled.
A logger.Error is emitted at startup if this invariant is violated.

https://claude.ai/code/session_01GKdjLHJH3n1CDut5j95H1u

Author: claude

config/config.go

@@ -117,8 +117,7 @@ func resolveIfaceToIP(bind string) (string, error) {
 }
 
 // resolveBindsToListens converts a list of bind names to host:port listen addresses.
-// "all" expands to 0.0.0.0 (which covers loopback too).
-// Otherwise 127.0.0.1 is always prepended if not already present.
+// "all" expands to 0.0.0.0. No implicit addresses are added.
 func resolveBindsToListens(binds []string, port string) ([]string, error) {
 	for _, b := range binds {
 		if b == "all" {
@@ -141,12 +140,19 @@ func resolveBindsToListens(binds []string, port string) ([]string, error) {
 		}
 	}
 
+	return addrs, nil
+}
+
+// hasLoopback returns true if listens contains 127.0.0.1:port or 0.0.0.0:port.
+func hasLoopback(listens []string, port string) bool {
 	loopback := net.JoinHostPort("127.0.0.1", port)
-	if !seen[loopback] {
-		addrs = append([]string{loopback}, addrs...)
+	wildcard := net.JoinHostPort("0.0.0.0", port)
+	for _, l := range listens {
+		if l == loopback || l == wildcard {
+			return true
+		}
 	}
-
-	return addrs, nil
+	return false
 }
 
 // getZeroconfInterfaces returns the network interfaces on which mDNS should be announced.
@@ -285,6 +291,10 @@ func New(cfgFile *string) (*Config, error) {
 		Enabled: viper.GetBool("api.ui.enabled"),
 	}
 
+	if uiCfg.Enabled && !hasLoopback(listens, portStr) {
+		logger.Error("[config] UI is enabled but 'lo' is not in bind list — UI will fail to reach the API (add 'lo' to bind)")
+	}
+
 	apiCfg := ApiConfig{
 		Enabled: viper.GetBool("api.enabled"),
 		Listens: listens,