fix(server): keep the Host-header check when binding to all interfaces

Binding HOST=0.0.0.0 no longer sets Vite's allowedHosts to true. The dev and
preview servers accept IP addresses, localhost and the LAN hostnames listed
in GEV_ALLOWED_HOSTS; suffix and wildcard entries are ignored. The
configuration factory takes the resolved list as an input, so build/vite.js
still reads no environment.

Ported from #97 to the current build/vite.js layout. Fixes #21.

Co-authored-by: Sameh Khamis <[email protected]>
Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

src/tooling/allowedHosts.test.mjs

@@ -0,0 +1,34 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  DEFAULT_ALLOWED_HOSTS,
+  resolveAllowedHosts,
+} from '../../build/allowedHosts.js';
+
+test('uses the restricted local host allowlist by default', () => {
+  assert.deepEqual(resolveAllowedHosts(), DEFAULT_ALLOWED_HOSTS);
+  assert.equal(resolveAllowedHosts().includes(true), false);
+});
+
+test('adds explicitly configured LAN hostnames without widening the allowlist', () => {
+  assert.deepEqual(
+    resolveAllowedHosts('globe.lan, globe.internal ,globe.lan'),
+    ['localhost', '127.0.0.1', 'globe.lan', 'globe.internal'],
+  );
+});
+
+test('ignores empty configured host entries', () => {
+  assert.deepEqual(resolveAllowedHosts(' , , globe.lan, '), [
+    'localhost',
+    '127.0.0.1',
+    'globe.lan',
+  ]);
+});
+
+test('rejects suffix and wildcard entries so every LAN hostname is explicit', () => {
+  assert.deepEqual(resolveAllowedHosts('.local,*.example,globe.lan'), [
+    'localhost',
+    '127.0.0.1',
+    'globe.lan',
+  ]);
+});