--lan: the desktop stays keyless; phone URLs drop loopback

Dogfooding caught both: the auto-opened desktop tab (and every old
polling tab) 403'd for lack of the key, and the "from your phone" list
offered 127.0.0.1. Loopback CLIENT connections now skip the key — a
network peer cannot arrive with a loopback client address — and fall
through to the same Host/Origin guard as the localhost default, so
rebinding pages (foreign Host) and cross-origin POSTs (foreign Origin)
from a local browser stay blocked. Loopback addresses are filtered out
of the printed phone URLs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016jXZFSTZQKzAC8fqpWSz9g

src/bggpipe/webreview.py

@@ -318,7 +318,13 @@ def create_app(
         host = (request.url.hostname or "").lower()
         origin = request.headers.get("origin")
         origin_host = urlsplit(origin).hostname if origin else None
-        if lan_token is not None:
+        client_ip = request.client.host if request.client else ""
+        loopback = client_ip.startswith("127.") or client_ip == "::1"
+        # Same-machine browsing stays keyless under --lan: a network peer
+        # cannot arrive with a loopback CLIENT address, and these requests
+        # fall through to the localhost guard below, which still blocks
+        # rebinding and cross-origin pages by their foreign Host/Origin.
+        if lan_token is not None and not (loopback and host in ALLOWED_HOSTS):
             # --lan has no login, so EVERY request — reads included: shelf
             # photos and pipeline state are private — needs the per-run
             # key from the printed URL; a cookie carries it afterwards.
@@ -1085,8 +1091,13 @@ def run_web_review(
     # type it once; the cookie remembers it from then on.
     token = secrets.token_urlsafe(16) if lan else None
     if lan:
-        ips = sorted(h for h in lan_hosts() if h.replace(".", "").isdigit())
-        names = sorted(h for h in lan_hosts() if not h.replace(".", "").isdigit())
+        hosts = lan_hosts()
+        ips = sorted(
+            h
+            for h in hosts
+            if h.replace(".", "").isdigit() and not h.startswith("127.")
+        )
+        names = sorted(h for h in hosts if not h.replace(".", "").isdigit())
         addresses = ", ".join(f"http://{h}:{port}/?k={token}" for h in ips + names)
         typer.echo(f"bggpipe web UI: {url}?k={token}")
         typer.echo(f"  from your phone, open: {addresses}")