Harden local UI startup

[amirgholipour]

What changed

• Bind the local Express server to 127.0.0.1 by default, with an explicit HOST override.
• Resolve a new chat-session log path without requiring the not-yet-created file to exist.
• Keep the existing log-directory containment check before appending.

Why this change is proposed

Two startup-path details make first-run development unreliable. The server currently binds using the platform default, which may expose a local development service beyond loopback. Separately, the first chat message calls realpathSync on a log file before that file exists, so a brand-new session can fail before its first append.

The server now has a safe loopback default, and the future log path is resolved and checked before creation.

Benefits

• Safer local defaults without changing deployed environments that set HOST.
• First messages work in newly created chat sessions.
• Existing traversal protection remains in place.
• The change is limited to server startup and logging behavior.

Validation

• Verified both changed server modules with Node syntax checks.
• Verified the integrated current UI can create and process a new session.
• Verified the production UI build completes with pnpm.
• Reviewed the branch against the current upstream main.

Authored by Saeed Kasmani (amirgholipour).