fix(server): keep the Host-header check when binding to all interfaces

Binding HOST=0.0.0.0 no longer sets Vite's allowedHosts to true. The dev and
preview servers accept IP addresses, localhost and the LAN hostnames listed
in GEV_ALLOWED_HOSTS; suffix and wildcard entries are ignored. The
configuration factory takes the resolved list as an input, so build/vite.js
still reads no environment.

Ported from #97 to the current build/vite.js layout. Fixes #21.

Co-authored-by: Sameh Khamis <[email protected]>
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

scripts/format-scope.json

@@ -55,6 +55,7 @@
   "server/standalone/vite.config.js",
   "vite.config.js",
   "src/tooling/viteBuild.test.mjs",
+  "src/tooling/allowedHosts.test.mjs",
   "server/providers/common/http.js",
   "server/providers/common/query.js",
   "server/providers/aircraft/opensky.js",

scripts/package-boundaries.json

@@ -31,6 +31,7 @@
     "modules": [
       "build/vite.js",
       "build/application-html.js",
+      "build/allowedHosts.js",
       "build/embed-framing.js",
       "build/panel.js"
     ],