fix(serve): stop serving WS token over HTTP and warn on non-loopback bind (H9)

[jkyberneees]

This PR closes H9 from the security roadmap.

Problem

odek serve previously embedded the per-instance WebSocket token in every GET / response (HTML meta tag + HttpOnly cookie). Because GET / was unauthenticated, any network attacker who could reach the port could fetch the token, upgrade to /ws, and drive the agent with the operator's model, tools, and API key.

Fix

The token is now treated like a Jupyter notebook token:

• On startup, the console prints the token and a URL of the form http://<addr>/?token=<token>.
• handleStatic only injects the cookie and meta tag when the request URL contains the correct ?token= parameter.
• A plain GET / still serves the UI, but with an empty token, so it cannot connect.
• Non-browser clients can continue to use the X-Odek-Ws-Token header or the odek.<token> WebSocket subprotocol.
• A prominent warning is printed when the server is bound to a non-loopback address.

Tests & docs

• Updated TestServe_CSRF_TokenRequired to verify the token is not leaked on a plain GET / and is delivered with ?token=.
• Added TestIsLoopbackAddr.
• Updated AGENTS.md and docs/SECURITY.md.