Warn at startup when binding to a non-loopback address

[SashaMIT]

Summary

• The multisig gRPC service is plaintext and unauthenticated: any caller that can reach the port can request signatures for every key this daemon holds.
• The default bind is loopback (127.0.0.1), which keeps that power on the local machine. But --address 0.0.0.0 (or any non-loopback bind) silently exposes a signing oracle to the network.
• Log a prominent startup warning when the bind address is not loopback, so the exposure is a deliberate operator choice rather than a configuration slip.

This mirrors the client-side warning for non-loopback tofnd-host values proposed in axelarnetwork/axelar-core#2387; together they cover both ends of the channel.

Test plan

• cargo check clean; cargo clippy introduces no new warnings.
• Default 127.0.0.1 bind logs nothing new; --address 0.0.0.0 logs the warning at startup.

Made with Cursor

Made with Cursor