Follow-up: opt-in gateway allowlist to restore Docker self-heal Repair under loopback-only internal_auth

Follow-up to Skyvern-AI/skyvern#6890 / PR Skyvern-AI/skyvern#7176.

Context

Skyvern-AI/skyvern#7176 fixes a trust-boundary bypass by restricting the internal/auth routes to loopback-only (127.0.0.1 / ::1), dropping the previous is_private (all-RFC1918) trust. That is the deliberate, correct security default.

Known intentional tradeoff: the local-dev self-heal "Repair" button (SelfHealApiKeyBanner.tsx → POST /api/v1/internal/auth/repair) used against a Dockerized backend (ENV=local) will now return 403, because a browser→published-port request reaches the container from the Docker bridge gateway IP (a private address), not loopback. Bare-metal skyvern run all is unaffected (the browser hits 127.0.0.1 directly).

Proposed follow-up

Add a narrow, opt-in, env-gated allowlist so operators who want the Docker self-heal path can trust exactly their Docker gateway IP — instead of re-trusting all of RFC1918. Sketch:

• New setting, default empty (e.g. INTERNAL_AUTH_TRUSTED_HOSTS), parsed to ipaddress addresses/networks.
• _is_local_request() returns True for loopback or an address explicitly in the allowlist.
• Empty default preserves the secure loopback-only behavior; the burden is on the operator to opt in to a specific gateway.

Non-goals

• Do NOT reintroduce blanket is_private trust.
• Keep the default secure (loopback-only).