Add security to HTTP server (e.g. health endpoint)

The project currently exposes an HTTP server with a health check endpoint. While this works fine for local or private deployments (e.g. running on a home server with no public ports), it would be insecure if deployed on a publicly accessible network.

### Problem

* The HTTP server does **not** implement any form of authentication, IP restriction, or rate limiting.
* If the server is ever run with an open port (e.g. on a VPS, cloud instance, or container), it would expose potentially sensitive endpoints or metadata to the internet.

### Goals

* Protect the health endpoint and any other exposed HTTP routes
* Ensure the server fails safe in public deployments
* Keep the local dev experience simple

### Possible Solutions

* Require a token or secret header to access the health endpoint
* Allow configuration of allowed IPs (e.g. `127.0.0.1` by default)
* Consider rate limiting or request throttling