fix(#1514): Bind WebSocket gateway to localhost by default

SECURITY: server.py was binding to 0.0.0.0:8765, making the
WebSocket gateway accessible from any network interface without
authentication.

Changes:
  - HOST defaults to 127.0.0.1 (localhost only)
  - Configurable via NEXUS_WS_HOST env var
  - PORT configurable via NEXUS_WS_PORT env var
  - Warning logged when binding to 0.0.0.0

For network access: NEXUS_WS_HOST=0.0.0.0 python3 server.py

Fixes #1514

server.py

@@ -7,6 +7,7 @@ the body (Evennia/Morrowind), and the visualization surface.
 import asyncio
 import json
 import logging
+import os
 import signal
 import sys
 from typing import Set
@@ -15,8 +16,8 @@ from typing import Set
 import websockets
 
 # Configuration
-PORT = 8765
-HOST = "0.0.0.0"  # Allow external connections if needed
+PORT = int(os.environ.get('NEXUS_WS_PORT', 8765))
+HOST = os.environ.get('NEXUS_WS_HOST', '127.0.0.1')  # Localhost by default. Set NEXUS_WS_HOST=0.0.0.0 for network access.
 
 # Logging setup
 logging.basicConfig(
@@ -81,6 +82,9 @@ async def broadcast_handler(websocket: websockets.WebSocketServerProtocol):
 
 async def main():
     """Main server loop with graceful shutdown."""
+    if HOST == '0.0.0.0':
+        logger.warning(f"Gateway binding to ALL interfaces (NEXUS_WS_HOST=0.0.0.0). "
+                       f"Accessible from network. Ensure firewall rules are in place.")
     logger.info(f"Starting Nexus WS gateway on ws://{HOST}:{PORT}")
     
     # Set up signal handlers for graceful shutdown