fix(web): advertise a reachable URL when --host binds all interfaces

[protonspy]

Problema

csdd web --host 0.0.0.0 parecia não expor o dashboard. O bind sempre esteve correto — o que estava quebrado era a URL impressa.

Go serve um bind 0.0.0.0 a partir de um socket dual-stack, então ln.Addr() volta como [::]:7777. Esse endereço era usado como a URL do dashboard e, com auth ligada, como base do magic link /token/<t>:

✓ csdd web → http://[::]:7799
• open authenticated: http://[::]:7799/token/rvzvmzc2rfekzb4e

Nenhum browser abre isso, e o link que carrega o token é justamente o que o usuário clica.

Correção

advertisedURL substitui o wildcard pelo endereço da própria interface (IPv4 preferido, o formato que se digita no browser), com fallback para localhost quando não há NIC roteável. Um bind explícito continua sendo reportado verbatim. Uma linha adicional nomeia o único elo que o csdd não controla — os firewalls do host e do provedor:

✓ csdd web → http://149.28.105.40:7777
• bound to all interfaces — a remote client also needs this port opened in the
  host firewall (ufw/iptables) and in any cloud provider firewall or security group.
• open authenticated: http://149.28.105.40:7777/token/<token>

Em VPS atrás de NAT o endereço é o privado em vez do público — ainda assim bem mais útil que o wildcard que substitui.

Nada muda no bind, no requireHost (que já abre em "*" para wildcard) nem na auth.

Validação

Além de make check, o servidor foi exercitado num VPS pelo IP público:

Teste	Resultado
GET / + /assets/index-*.{js,css}	200 (4.3 MB / 172 KB)
/token/<t>	200, serve o SPA
/api/{overview,tree,plans} sem token	401
idem com Bearer, e token errado	200 / 401
/api/graph	404 antes do graph build, 200 gzip depois
/api/events (SSE)	event: change imediato
Host: dominio-externo	200 (guard wildcard)

Dois testes novos fixam o comportamento: wildcard reescrito para um host abrível na porta correta, e bind explícito preservado.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QxSUgxkG2hwDuRxGdFKLLP

Summary by CodeRabbit

• Bug Fixes
  • Improved the local browser URL shown when the server listens on all network interfaces.
  • Preserved the correct port while replacing wildcard addresses with a reachable local address.
  • Added a firewall reminder when access may require opening the port on the host or cloud firewall.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c020f26f-fed8-4dcf-bb2a-2a25e6615c0d

📥 Commits

Reviewing files that changed from the base of the PR and between 178ec87 and 4c67388.

📒 Files selected for processing (2)

• internal/web/server.go
• internal/web/server_test.go

---

📝 Walkthrough

Walkthrough

Changes

Wildcard URL Advertisement

Layer / File(s)	Summary
Reachable URL construction internal/web/server.go, internal/web/server_test.go	advertisedURL rewrites wildcard binds to a primary non-loopback address, preserves the TCP port, falls back to localhost, and is tested alongside explicit-host behavior.
Startup banner integration internal/web/server.go	Serve uses advertisedURL and passes wildcard-bind state to printStartup, which reports host or cloud firewall requirements.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: advertising a reachable URL when binding to all interfaces.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/web-wildcard-advertised-url

---

_{Comment @coderabbitai help to get the list of available commands.}