security: bind uvicorn to 127.0.0.1 instead of 0.0.0.0

The install wizard wrote '--host 0.0.0.0' which exposed the raw uvicorn
port 8600 on the public IP, bypassing Nginx HTTPS/TLS/WAF/middleware.
Changed to 127.0.0.1 — only local Nginx can reach the backend.

Also applied to running server via supervisor config fix.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/api/install.py

@@ -216,7 +216,7 @@ def _configure_guardian(install_dir: str, api_port: str) -> list[str]:
 
     supervisor_conf = (
         f"[program:nexus]\n"
-        f"command={install_dir}/venv/bin/uvicorn server.main:app --host 0.0.0.0 --port {api_port}\n"
+        f"command={install_dir}/venv/bin/uvicorn server.main:app --host 127.0.0.1 --port {api_port}\n"
         f"directory={install_dir}\n"
         f"user=root\n"
         f"autostart=true\n"