security: bind localhost by default in the sandbox helper

tools/demo_sandbox.sh defaulted to 0.0.0.0:8080. The binary itself already
defaults to 127.0.0.1 and so do the just recipes, so this was the one host-run
path that exposed every interface without being asked.

It serves a language model with no authentication, no quota and no rate limit.
Exposing that should be a decision someone makes, not one they inherit from a
default, so MAINARCH_DEMO_BIND=0.0.0.0:8080 is now the explicit opt-in and the
docs say to put a proxy in front when taking it.

The container images still bind 0.0.0.0, which is correct inside a container
where the real decision is which ports get published.

Author: maincode-dave

docs/demo-sandbox.md

@@ -169,3 +169,10 @@ Not claimed in any mode:
 
 Keep auth, quota, prompt policy, and abuse controls in front of this process,
 not inside it. It is a demonstration surface, not a public serving endpoint.
+
+Everything here binds to `127.0.0.1` by default, deliberately. It serves a
+language model with no authentication, no quota and no rate limit, so exposing
+it should be something you choose rather than something you inherit. Set
+`MAINARCH_DEMO_BIND=0.0.0.0:8080` when you mean it, and put a reverse proxy in
+front. The container images bind `0.0.0.0` because that is correct inside a
+container, where the decision is which ports you publish.

tools/demo_sandbox.sh

@@ -2,7 +2,11 @@
 set -euo pipefail
 
 MODE="${1:-serve}"
-BIND="${MAINARCH_DEMO_BIND:-0.0.0.0:8080}"
+# Localhost by default. This serves an LLM with no auth, no quota and no rate
+# limit, so binding every interface has to be a decision someone makes rather
+# than one they inherit. Set MAINARCH_DEMO_BIND=0.0.0.0:8080 to expose it, and
+# put a reverse proxy in front when you do.
+BIND="${MAINARCH_DEMO_BIND:-127.0.0.1:8080}"
 NODE="${MAINARCH_DEMO_NODE:-2}"
 BIN="${MAINARCH_DEMO_BIN:-./target/release/mainarch}"
 PORT="${BIND##*:}"
@@ -23,7 +27,7 @@ Environment:
 
 Examples:
   bash tools/demo_sandbox.sh build
-  MAINARCH_DEMO_BIND=0.0.0.0:8080 MAINARCH_DEMO_NODE=2 bash tools/demo_sandbox.sh serve
+  MAINARCH_DEMO_BIND=0.0.0.0:8080 MAINARCH_DEMO_NODE=2 bash tools/demo_sandbox.sh serve   # expose it
   MAINARCH_DEMO_URL=http://127.0.0.1:8080 bash tools/demo_sandbox.sh smoke
 EOF
 }