refactor(robonix-api): make MCP DNS-rebinding opt-out explicit (follow-up to #86)

[enkerewpo]

Optional follow-up to the fix merged in #86, which used FastMCP(self.id, host="0.0.0.0"). No behavior change — this only makes the intent explicit and responds to the automated security review on the commit.

Background

• Passing host="0.0.0.0" to FastMCP does not change the listen socket. The socket is bound by _start_mcp_server's uvicorn host="0.0.0.0" (capability.py:750), and the lifecycle gRPC has always bound 0.0.0.0 (:688). The host arg only matters when transport_security is unset and the host is loopback, where the SDK adds a localhost-only allowed_hosts (mcp/server/fastmcp/server.py:178). So "0.0.0.0" was just a side-effect way of skipping that auto-allowlist, and reads misleadingly as if it changed the bind address.
• The 421 is therefore also unrelated to the /mcp/ trailing slash: the 307 redirect is incidental, and a direct POST /mcp 421s under the old code too. The cause is the default host=127.0.0.1 triggering the localhost-only Host-header allowlist.

Change

host="0.0.0.0" → explicit transport_security=TransportSecuritySettings(enable_dns_rebinding_protection=False), with a clarifying comment.

Security note (responding to the automated review)

• The 0.0.0.0 listen socket pre-dates this change (both uvicorn and the Driver gRPC). This change only relaxes the application-layer Host-header allowlist.
• DNS-rebinding protection defends a browser attack surface (a malicious page driving a victim browser at a loopback service). Robonix's executor→provider call is server-to-server and does not go through a browser, so the control does not apply to this threat model — leaving it on only blocks legitimate cross-host calls.
• The genuine residual risk is unauthenticated access to hardware-control endpoints on a routable network, which is a property of the entire v0.1 wire (atlas / Driver gRPC / MCP are all unauthenticated) and the trusted-LAN/VPN deployment posture — not something this single MCP change should carry. End-to-end authentication (token / mTLS) is a separate, wire-wide hardening item worth tracking in its own issue.

Does not touch the v0.1 frozen surface; purely an internal robonix-api expression change.