[MarcelRoozekrans]

Summary

• codeburn web only listens on 127.0.0.1, and its guard refuses any Host or Origin that isn't a loopback name. That is the right default, but it also makes the dashboard unreachable behind a reverse proxy, even one that authenticates: oauth2-proxy, Authelia, SSO forward auth. I run it on a headless VM and reach it through Traefik behind Keycloak, and today every proxied request gets a 403.
• New opt-in flags: --host <address> sets the listen address, default 127.0.0.1. --allowed-host <name> is repeatable and adds exact hostnames. They are matched case-insensitively and without the port, against both Host and Origin. Without the flags nothing changes; with them, any other host or origin still gets a 403.
• The guard moved into two exported helpers, isAllowedHost and isAllowedOrigin, with unit tests: loopback default, exact matching (dash.example.org.evil.example and evil-dash.example.org are refused), Origin limited to http and https, null refused. There are also server tests that send a proxied Host, an allowed Origin, and refused ones. docs/web.md gains a "Behind a reverse proxy" section saying the dashboard has no login, so the port should be firewalled to the proxy.

Testing / Verification

• I have tested this locally against real data, not just unit tests. I ran node dist/cli.js web --no-open --port 4799 --allowed-host usage.roozekrans.nl on 30 days of Claude Code history and got:
  • Host: 127.0.0.1:4799 → 200
  • Host: usage.roozekrans.nl:8200 → 200, real payload of 33,463 calls
  • Host: evil.example → 403
  • allowed Host with Origin: https://evil.example → 403
• npm test passes: 5,216 pass, 1 fails. The failure is tests/serve-stdio.test.ts, "reflects a single appended call on the poll after it", and it fails the same way on unchanged main on this machine, so it isn't caused by this PR. tests/web-dashboard.test.ts: 9/9 pass.
• npm run build succeeds, and tsc --noEmit is clean.
• Not a UI change.