Bind backend to 127.0.0.1 for Electron local-only deployment

[matthewhorridge]

We’re running the Flask backend locally from an Electron app. Even in local-only mode, we should avoid exposing the backend on external interfaces.

Scope:

• Bind the backend server to 127.0.0.1 only (avoid 0.0.0.0).
• Ensure any default dev/server config uses localhost explicitly.

Acceptance criteria:

• Backend only listens on localhost.
• Any run scripts/documentation show 127.0.0.1 as the bind address.
• Verified that the Electron app can still reach the backend via localhost.

Notes:

• This is a local-only app, but binding to localhost prevents other devices on the network from accessing the API if the port is exposed.