rowboat-server: no Host header validation (DNS rebinding)

From PR #758 review. When LAN exposure is enabled, rowboat-server answers any request bearing the key, with no Host check. A malicious page doing DNS rebinding against a LAN-bound server can't present the bearer key, so exposure is limited — but a Host allowlist (localhost + the machine's own addresses) is cheap defense-in-depth and standard for local HTTP servers.

Fix: validate Host on every request; reject with 403 otherwise.