fix(app): bind Vite dev server to localhost only

Remove --host flag from dev.sh that was overriding vite.config.ts to
bind on 0.0.0.0. Server now defaults to localhost; use VITE_HOST env
var to opt-in to LAN access for mobile testing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/app/scripts/dev.sh

@@ -31,8 +31,8 @@ else
   sleep 0.3
 fi
 
-# Start Vite dev server in background
-"$BIN/vite" --host &
+# Start Vite dev server in background (host binding controlled by vite.config.ts / VITE_HOST)
+"$BIN/vite" &
 
 # Wait for all background jobs (compatible with bash 3.2 on macOS)
 wait

packages/app/vite.config.ts

@@ -131,7 +131,7 @@ export default defineConfig({
   },
   server: {
     port: 5173,
-    host: true,
+    host: process.env.VITE_HOST || 'localhost',
     open: false,
     proxy: {
       '/api/claude': {