fix(app): preserve loopback server host

[Brendonovich]

Summary

• use the page hostname for the default dev server when loaded from a loopback URL
• keep explicit server host configuration and the existing non-loopback fallback unchanged
• preserve browser Basic Auth credentials by avoiding 127.0.0.1 to localhost origin changes

Testing

• bun typecheck (packages/app)
• pre-push workspace typecheck

[Enough1122]

AI code review — automated review for reference, author can ignore or act on any point.

Sound fix. Mirroring the page hostname for loopback loads keeps the dev server request same-origin, which is exactly what preserves Basic Auth credentials and avoids needless CORS preflights between 127.0.0.1 and localhost. I checked the matchers: location.hostname does include brackets for IPv6 ("[::1]" per the URL spec), and startsWith("127.") can't false-positive on lookalike hosts like 127evil.com since the dot is required — both are correct as written.

Two small points:

1. Coverage: this ships with typecheck-only validation. The logic is pure except for reading location, so extracting something like resolveDevServerHost(pageHostname: string): string would make the loopback matrix (localhost, [::1], 127.x.x.x, non-loopback, explicit VITE_OPENCODE_SERVER_HOST override) unit-testable in one table-driven test. Cheap insurance for a function two PRs have now touched in a row.

2. Non-loopback dev pages still target localhost: loading the dev app from a LAN IP still sends API calls to localhost:4096, which fails unless forwarded. That's pre-existing and the summary marks it intentionally unchanged — just confirming that's deliberate rather than an oversight, since the same "mirror the page host" argument could be made there (with the caveat that remote devices genuinely may want a different backend).