Server access, binding, and bounded shutdown

Authorize management and data-plane requests from the numeric node:http socket peer before CORS, imports, body reads, authentication, storage, or upstream calls; never trust Host, Origin, Forwarded, or X-Forwarded-For as peer identity. Non-loopback peers get bodyless 404s unless remote management is enabled, which additionally requires exact normalized Host/port matching and rejects loopback browser Origins. Apply this to startServer(), upgrades, /, /api, and /ui. Warn visibly when an explicitly configured host is skipped for EADDRNOTAVAIL/EADDRNOTFOUND; continue only if another host binds. For shutdown, track every socket through close, then use deadline-driven closeIdleConnections(), closeAllConnections(), and explicit destruction because partial headers and upgraded sockets can outlive server.close(). Keep closure bounded and idempotent.