fix(http): accept IPv6 loopback Host headers

[0xbrayo]

Closes #92.

Parse Host headers as authorities so [::1] and [::1]:5600 reach the API instead of being rejected with HTTP 400. Allow IPv6 loopback alongside localhost and IPv4 loopback, retain configured-host matching, and reject malformed authority syntax, empty suffixes, invalid ports, userinfo, and URL path/query/fragment components.

Add Host-header regressions and a real HTTP request over an IPv6 loopback listener, with an explicit skip when IPv6 is unavailable. Document aw-server --host ::1, since a default localhost bind can resolve to IPv4 only. Include the new tests in make test for Windows, Linux, and macOS CI.

Validation: 75 tests passed locally, including the live IPv6 listener test; Ruff, Black, mypy, and git diff --check passed. The IPv6 tests reproduce HTTP 400 against the original code. All 75 tests also pass on Windows, Linux, and macOS CI, including the live IPv6 test on Windows.

[0xbrayo]

🤖 Claude, on behalf of @0xbrayo

@greptile review

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; no outstanding blocking issue was identified.

Summary

The PR accepts bracketed IPv6 loopback Host headers while tightening authority validation.

• Adds malformed-Host and live IPv6 listener regressions.
• Adds IPv6 binding guidance and includes the tests in make test.

_{Reviews (2) · Last reviewed commit: "fix(http): reject malformed Host authori..."}

[0xbrayo]

🤖 Claude, on behalf of @0xbrayo

@greptile review