[Bl0ck154]

Change

Backport the browser dashboard security boundary from upstream PR Lampese#178 onto this fork's main (v0.2.21). No desktop account management or updater behavior is intentionally changed.

• Bind codex-web to 127.0.0.1 by default.
• Require CODEX_SWITCHER_WEB_SECRET before accepting a non-loopback bind and check the bearer token before any /api/invoke/* command.
• Restrict Host headers in the local secret-free mode.
• Require a single JSON Content-Type for command POST requests and cap bodies to 2 MiB.
• Keep the browser-provided secret in sessionStorage, rather than URLs or release assets.
• Document the remote access requirements.

Merge resolution

Upstream Lampese#178 overlaps package.json with our test:updater command. Both test scripts are retained; the other five files applied without conflicts.

Validation

• node --experimental-strip-types --test tests/webBoundary.test.ts: passed (1 test).
• git diff --check: passed.
• Frontend/Rust/platform CI pending for this branch.

This only creates a review branch. It does not change any production service or installed Codex Switcher.