feat: add HTTP Basic Auth and --host bind restriction

[johnoct]

Summary

• Default web UI bind address changed to 127.0.0.1 (localhost only) via new --host flag, preventing unintended network exposure
• New --password flag enables HTTP Basic Auth on all web routes using a before_request hook
• Prints warning when binding to 0.0.0.0 without --password set

Design

HTTP Basic Auth chosen over bearer tokens because MJPEG streaming uses <img src="/stream"> which cannot set custom headers — Basic Auth is native to the browser and works transparently. Any username accepted, only password is checked.

Usage

# Local only (default)
babyping

# Network accessible with auth
babyping --host 0.0.0.0 --password mysecret

Test plan

• 213 tests passing (11 new auth + host tests)
• 401 returned when password set and no auth provided
• 401 returned with wrong password
• 200 returned with correct credentials
• Auth enforced on all endpoints (/, /status, /events)
• Any username accepted (only password matters)
• No auth required when --password not set
• --host defaults to 127.0.0.1
• start_web_server() respects host parameter

Closes #19