fix: restore ISSUE_LOCK_FILE import and fail-closed public bind

Conflict resolution left webui/lease_loader.py importing ISSUE_LOCK_FILE
from merged_cleanup_reconcile (not exported); import from
issue_lock_provenance instead. Validate WEBUI_HOST before loading the
full app stack so 0.0.0.0 refuse exits immediately.

Addresses reviewer findings on PR #456 / issue #435.

webui/__main__.py

@@ -7,7 +7,6 @@ import os
 
 import uvicorn
 
-from webui.app import create_app
 from webui.deployment_boundary import assess_bind_host
 
 logger = logging.getLogger("webui")
@@ -25,9 +24,13 @@ def _validate_bind_host(host: str) -> None:
 def main() -> None:
     host = os.environ.get("WEBUI_HOST", "127.0.0.1")
     port = int(os.environ.get("WEBUI_PORT", "8765"))
+    # Validate bind host before importing the full app stack so refuse paths
+    # fail closed quickly (tests and operators must not hang on create_app).
     _validate_bind_host(host)
+    from webui.app import create_app
+
     uvicorn.run(create_app(), host=host, port=port, log_level="info")
 
 
 if __name__ == "__main__":
-    main()
+    main()

webui/lease_loader.py

@@ -11,7 +11,8 @@ from urllib.parse import urlparse
 
 from gitea_auth import api_fetch_page, get_auth_header, repo_api_url
 from issue_claim_heartbeat import build_claim_inventory
-from merged_cleanup_reconcile import ISSUE_LOCK_FILE, read_issue_lock
+from merged_cleanup_reconcile import read_issue_lock
+from issue_lock_provenance import ISSUE_LOCK_FILE
 
 from webui.project_registry import ProjectRecord, load_registry
 from webui.queue_loader import _extract_linked_issue, _fetch_issues, _fetch_prs