fix(cli): allow proxy authority on loopback

[xingkaixin]

Summary

• enforce loopback authority validation only for unauthenticated local listeners
• preserve token and trusted-proxy TLS checks for authenticated reverse-proxy deployments
• cover a public proxy Host header on a loopback-bound listener

Root cause

The loopback authority middleware was selected from the bind address alone. A trusted-proxy deployment still binds to loopback, so the middleware rejected the proxy's public Host header before token authentication and forwarded-TLS validation could run.

Verification

• pnpm --filter codesesh lint
• pnpm --filter codesesh format:check
• pnpm --filter codesesh test
• pnpm --filter codesesh build

Issue: CS-186