fix: preserve loopback access for host configuration

- Keep internal loopback HTTP APIs reachable when the server is bound to a
specific non-loopback host by adding a dedicated 127.0.0.1 listener.

- Move listener address helpers into utils and normalize HTTPS redirect hosts so
IPv6 request hosts are not double-bracketed.

server/utils/listener.go

@@ -0,0 +1,28 @@
+package utils
+
+import (
+	"fmt"
+	"net"
+	"strings"
+)
+
+func ListenAddr(host string, port string) string {
+	if host == "" {
+		return fmt.Sprintf(":%s", port)
+	}
+	return net.JoinHostPort(host, port)
+}
+
+func NeedsDedicatedLoopbackListener(host string) bool {
+	host = strings.TrimSpace(strings.Trim(host, "[]"))
+	if host == "" {
+		return false
+	}
+
+	ip := net.ParseIP(host)
+	if ip == nil {
+		return !strings.EqualFold(host, "localhost")
+	}
+
+	return !ip.IsLoopback() && !ip.IsUnspecified()
+}