fix(#1514): Bind WebSocket gateway to localhost by default

SECURITY: server.py was binding to 0.0.0.0:8765, making the
WebSocket gateway accessible from any network interface without
authentication.

Changes:
  - HOST defaults to 127.0.0.1 (localhost only)
  - Configurable via NEXUS_WS_HOST env var
  - PORT configurable via NEXUS_WS_PORT env var
  - Warning logged when binding to 0.0.0.0

For network access: NEXUS_WS_HOST=0.0.0.0 python3 server.py

Fixes #1514

index.html

@@ -165,18 +165,18 @@
 
   <!-- Top Right: Agent Log, Atlas & SOUL Toggle -->
   <div class="hud-top-right">
-    <button id="atlas-toggle-btn" class="hud-icon-btn" title="Portal Atlas">
-      <span class="hud-icon">🌐</span>
-      <span class="hud-btn-label">WORLDS</span>
-    </button>
+    <button id="atlas-toggle-btn" class="hud-icon-btn" title="World Directory">
     <button id="soul-toggle-btn" class="hud-icon-btn" title="Timmy's SOUL">
       <span class="hud-icon">✦</span>
       <span class="hud-btn-label">SOUL</span>
-    </button>
     <button id="mode-toggle-btn" class="hud-icon-btn mode-toggle" title="Toggle Mode">
       <span class="hud-icon">👁</span>
       <span class="hud-btn-label" id="mode-label">VISITOR</span>
     </button>
+    <button id="atlas-toggle-btn" class="hud-icon-btn" title="Portal Atlas">
+      <span class="hud-icon">🌐</span>
+      <span class="hud-btn-label">WORLDS</span>
+    </button>
     <div id="bannerlord-status" class="hud-status-item" title="Bannerlord Readiness">
       <span class="status-dot"></span>
       <span class="status-label">BANNERLORD</span>

server.py

@@ -7,6 +7,7 @@ the body (Evennia/Morrowind), and the visualization surface.
 import asyncio
 import json
 import logging
+import os
 import signal
 import sys
 from typing import Set
@@ -15,8 +16,8 @@ from typing import Set
 import websockets
 
 # Configuration
-PORT = 8765
-HOST = "0.0.0.0"  # Allow external connections if needed
+PORT = int(os.environ.get('NEXUS_WS_PORT', 8765))
+HOST = os.environ.get('NEXUS_WS_HOST', '127.0.0.1')  # Localhost by default. Set NEXUS_WS_HOST=0.0.0.0 for network access.
 
 # Logging setup
 logging.basicConfig(
@@ -81,6 +82,9 @@ async def broadcast_handler(websocket: websockets.WebSocketServerProtocol):
 
 async def main():
     """Main server loop with graceful shutdown."""
+    if HOST == '0.0.0.0':
+        logger.warning(f"Gateway binding to ALL interfaces (NEXUS_WS_HOST=0.0.0.0). "
+                       f"Accessible from network. Ensure firewall rules are in place.")
     logger.info(f"Starting Nexus WS gateway on ws://{HOST}:{PORT}")
     
     # Set up signal handlers for graceful shutdown