Basic auth when binding beyond localhost

[AVPthegreat]

Enable simple Basic Auth when host != 127.0.0.1 (off by default).\n\nAcceptance Criteria:\n- Disabled by default\n- When enabled, all routes require auth\n- Documented risks