fix(computer-server): harden unauthenticated network access

[civonafets]

Summary

• refuse non-loopback binds when local request authentication is disabled
• apply the same bind check to the CLI and programmatic Server API
• make direct main.py execution bind to loopback
• reject non-loopback browser origins across local HTTP, WebSocket, MCP, PTY, shell, file, agent, and Playwright routes
• document authenticated remote deployment and the explicit development-only override

Why

Local mode intentionally permits requests without a CONTAINER_NAME, but the server exposes shell execution, arbitrary filesystem access, PTYs, browser control, and desktop input. Binding that mode to a network interface turns the service into unauthenticated remote code execution. Binding to loopback alone also leaves it reachable from a malicious web page unless browser origins are checked.

Current main already defaults the normal CLI to 127.0.0.1. This change closes the remaining startup paths, prevents an explicit remote bind from silently disabling the protection, and covers the mounted MCP and other control routes that were not included in #1899. Authenticated container deployments keep their existing external-origin behavior. An isolated development setup can acknowledge the risk with CUA_ALLOW_UNAUTHENTICATED_REMOTE=1.

Tests

• Black and Ruff checks for all changed Python files
• CUA_TELEMETRY_ENABLED=false uv run --group test pytest libs/python/computer-server/tests -q (75 passed)

Closes #1892