Opt-in authenticated access to the local API from another machine

The local HTTP API is bound to 127.0.0.1, so only software on the same Mac can reach it. Anything self hosted elsewhere cannot.

A setting to bind to the LAN, or to accept an authenticated connection from a specific host, would let a self hosted automation platform drive Vowen directly. The bearer token in cli/server.json is already the right mechanism, it just is not reachable from anywhere else.

Defaulting to loopback is the correct and safe choice. This is a request for an opt-in, off by default.