feat(webui): auth and deployment boundary (#435)

Add bind-host assessment that refuses 0.0.0.0/:: without override,
warns on non-loopback binds, and documents internal-only MVP serving.
Health endpoint exposes deployment metadata; docs cover Access/VPN/WARP
and runtime env assumptions without embedding secrets in the client.

Closes #435

webui/__main__.py

@@ -2,16 +2,30 @@
 
 from __future__ import annotations
 
+import logging
 import os
 
 import uvicorn
 
 from webui.app import create_app
+from webui.deployment_boundary import assess_bind_host
+
+logger = logging.getLogger("webui")
+
+
+def _validate_bind_host(host: str) -> None:
+    assessment = assess_bind_host(host)
+    if assessment.disposition == "refuse":
+        logger.error("webui bind refused: %s", assessment.message)
+        raise SystemExit(1)
+    if assessment.disposition == "warn":
+        logger.warning("webui bind warning: %s", assessment.message)
 
 
 def main() -> None:
     host = os.environ.get("WEBUI_HOST", "127.0.0.1")
     port = int(os.environ.get("WEBUI_PORT", "8765"))
+    _validate_bind_host(host)
     uvicorn.run(create_app(), host=host, port=port, log_level="info")