--lan startup: lead with the default-route address, demote the rest

A multi-homed machine (VM bridges, Ethernet + Wi-Fi) has several
addresses and the server cannot know which network the phone is on —
but the OS's default route is the right answer nearly always. The
banner now prints one "on your phone" URL from the route probe, with
the other interfaces on an if-that-doesn't-answer line; when the probe
fails, the settings hint plus candidates.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016jXZFSTZQKzAC8fqpWSz9g

tests/test_webreview.py

@@ -1007,17 +1007,21 @@ def test_run_web_review_lan_branch_binds_and_warns(tmp_path, monkeypatch, capsys
     captured = {}
     monkeypatch.setattr("uvicorn.run", lambda app, **kw: captured.update(kw, app=app))
     cfg = make_cfg(tmp_path)
+    monkeypatch.setattr(wr, "_route_ip", lambda: "192.168.1.5")
     monkeypatch.setattr(
-        wr, "lan_hosts", lambda: {"127.0.0.1", "192.168.1.5", "erics-mac.local"}
+        wr,
+        "lan_hosts",
+        lambda: {"127.0.0.1", "192.168.1.5", "192.168.64.1", "erics-mac.local"},
     )
     wr.run_web_review(cfg, port=9999, lan=True)
     out = capsys.readouterr().out
     assert captured["host"] == "0.0.0.0"
-    assert "?k=" in out  # every printed URL carries the access key
-    assert "http://192.168.1.5:9999/?k=" in out
-    # no phone can reach loopback: it never appears in the phone list
-    assert "phone" not in out.split("http://127.0.0.1:9999")[-1].split("\n")[0]
-    assert out.count("http://127.0.0.1:9999") == 1  # the desktop line only
+    # the default-route address leads; other interfaces are fallbacks
+    assert "on your phone, open: http://192.168.1.5:9999/?k=" in out
+    fallback = next(line for line in out.splitlines() if "try:" in line)
+    assert "192.168.64.1" in fallback and "erics-mac.local" in fallback
+    # no phone can reach loopback: only the desktop line mentions it
+    assert out.count("http://127.0.0.1:9999") == 1
     assert "Use only on a network you trust" in out
     wr.run_web_review(cfg, port=9999, lan=False)
     assert captured["host"] == "127.0.0.1"