The server builds its hostname allow-set once at startup. When users
add a new hostname via the CLI, the config file is updated but the
running server doesn't reload it. This adds a clear message telling
users to restart the server for the change to take effect.
Fixes#538
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Reject requests from unrecognised Host headers when running
authenticated/private. Adds server middleware, CLI `allowed-hostname`
command, config-schema field, and prompt support for configuring
allowed hostnames during onboard/configure.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>