D116 — Viewer binds loopback by default, token elsewhere

Decision

The live viewer binds 127.0.0.1 by default; on any other address it requires a random token (page and /ws; URL once, then an HttpOnly; SameSite=Strict cookie), unless --view-insecure. Every /ws upgrade with an Origin must come from the server's own origin; a loopback viewer without a token also checks Host; at most 16 WebSocket viewers and 128 connections; TM_VIEW_HOST sets the host once (issue #4)

Alternatives

Keeping 0.0.0.0 as the default and documenting it (docs/09 already promised loopback, and the stream carries the whole board); TLS (certificates are a deployment problem, an SSH tunnel with the loopback bind covers the untrusted-network case); a login or accounts; a token only for remote clients with no Origin check (a web page open in the browser reaches a loopback viewer too)

Reason

The issue is right that the code did not do what docs/09 said. The default is what changes behaviour: anyone who watched a route from another machine now adds --view-host 0.0.0.0 (or TM_VIEW_HOST) and opens the printed URL. A token in the URL is weak against someone who can read the network, and the notice says so (docs/09 Security)