Harden server mode: require auth for non-loopback binds (secure-by-default)

Description

This is not an issue but an much needed hardening for non-loopback bind + no auth case.

Summary

opencode serve / opencode web print a warning and then start unauthenticated
when bound to a non-loopback address without OPENCODE_SERVER_PASSWORD. Because the CLI
actively advertises this configuration — opencode web --hostname 0.0.0.0 prints
ready-to-use "Network access: http://:" URLs, and --mdns defaults the
hostname to 0.0.0.0 — a user following the printed instructions ends up exposing an API
that can spawn processes on the host with no credentials.

This is a secure-by-default / hardening request, not a new vulnerability report. The
underlying unauthenticated-server behavior is already documented (CVE-2026-22812) and I
understand per SECURITY.md that securing server mode is the operator's responsibility. This
issue only asks that the default not lead users into that exposure.

The gap

The problem isn't that server mode can be unauthenticated — it's that the CLI's own output
(web network URLs, --mdns binding to 0.0.0.0) actively steers users toward binding
non-loopback without a password.

Suggested mitigations (any one closes the gap)

1. Refuse to bind a non-loopback address unless OPENCODE_SERVER_PASSWORD is set, with a
   clear error. Loopback-only stays passwordless, as today.
2. Or: auto-generate a random session password when binding non-loopback without one, print
   it once at startup, and require it.
3. Don't print "Network access" URLs unless auth is configured.

Expected vs actual (mitigation 1)

• Expected: opencode serve --hostname 0.0.0.0 without a password exits with:
  "Refusing to bind 0.0.0.0 without authentication. Set OPENCODE_SERVER_PASSWORD, or use
  --hostname 127.0.0.1 for local-only access."
• Actual: warning printed, server starts unauthenticated on all interfaces.

Plugins

No response

OpenCode version

1.18.18

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response