hotfix: bind Electron API server to loopback

[WINBIGFOX]

Summary

This hotfix binds the internal Electron API server to the loopback interface instead of allowing Node to bind on all available interfaces.

Problem

The Electron API server is used for PHP <-> Electron communication and is protected by the X-NativePHP-Secret header. However, because listen() was called without an explicit host, Node could bind the server to external interfaces depending on the environment.

For a desktop app, this internal API should not be reachable from other hosts on the LAN at all.

Changes

• Check API port availability on 127.0.0.1.
• Start the Express API server with an explicit 127.0.0.1 bind host.
• Update NATIVEPHP_API_URL to use 127.0.0.1 instead of localhost.
• Update committed Electron plugin dist output.
• Add test coverage to verify the API server binds to 127.0.0.1 and not 0.0.0.0.

Verification

• npm run plugin:build
• npm run plugin:test

Notes

This does not change the public API. PHP <-> Electron communication continues to use the same port range and secret header, but the server is no longer exposed on external network interfaces.