Decide the default bind address for switchyard-server

Problem

switchyard-server currently binds to 0.0.0.0 when --host is omitted. #584 proposes changing that default to 127.0.0.1 to reduce accidental network exposure.

This is more than a one-line security fix. It changes how the standalone server is deployed:

• dev-server/switchyard.service relies on the current default and would stop accepting remote traffic.
• The root Docker image exposes port 4000, but a published container port cannot reach a process bound to container-local loopback.
• Existing remote users would need to add --host 0.0.0.0.

Both behaviors are already available through --host. The decision is which one should be the default.

Decision needed

Should the standalone server default to local-only access, or should it remain network-reachable by default?

Loopback reduces accidental exposure, but it is not authentication. Keeping 0.0.0.0 better matches a deployable proxy, but requires users to secure the surrounding network appropriately.

If we change the default, the CLI, systemd service, Docker path, documentation, migration note, and a focused regression test should be updated together.

Related: #584

Start by tracing how switchyard-server chooses its default for --host, then inspect dev-server/switchyard.service and the root Docker image's port-4000 path. Review the related discussion in #584 before deciding between loopback and network-reachable defaults. Done means the decision is recorded and, if changed, the CLI, service, Docker path, documentation, migration note, and focused regression test agree.