Add opt-in, fail-closed Tailnet binding for the local API server

[hmmhmmhm]

Summary

Allow TurboFieldfareServer to serve trusted devices in the same Tailnet without opening the API to the local LAN or requiring a separate proxy.

The server currently binds exclusively to loopback. That is the safest default, but it also prevents using the model from another personally controlled device. A generic --host option or 0.0.0.0 binding would make accidental exposure too easy, so this change intentionally provides a narrower option:

TurboFieldfareServer \
  --model scratch/gemma4.gturbo \
  --bind tailnet

When --bind tailnet is selected, the server:

• obtains the machine IPv4 address from tailscale ip -4;
• binds only to that exact Tailnet address;
• never binds to 0.0.0.0 or another wildcard interface;
• fails instead of falling back when Tailscale cannot be detected.

The default remains loopback, so existing commands and their security properties are unchanged.

The README, server guide, and agent instructions now document the same safety boundary: Tailnet binding is explicit, relies on the Tailnet ACL, and does not add application-level authentication or TLS.

Validation

Passed:

Scripts/test.sh --filter ServerArgumentTests
swift build -c release --product TurboFieldfareServer
ruby Scripts/check_markdown_links.rb

Results:

• All 3 server argument tests passed.
• The release TurboFieldfareServer product built successfully.
• All 22 Markdown files passed local link and anchor validation.
• The default bind mode remains loopback.
• Unsupported bind modes are rejected.

Tailnet-address API smoke test:

GET http://<tailnet-ip>:8080/health
→ {"status":"ok"}

GET http://<tailnet-ip>:8080/v1/models
→ gemma-4-26b-a4b-it

Chat Completions request:

Prompt: 대한민국의 수도는 어디인가요? 한 문장으로 답하세요.
Output: 대한민국의 수도는 서울입니다.
Usage: 29 prompt tokens, 9 completion tokens

Test environment:

MacBook Pro (Mac16,7)
Apple M4 Pro, 24 GB
macOS 26.2
Swift 6.3.2

Memory and performance

Not applicable.

This change does not modify model loading, inference, Metal kernels, KV cache, or bounded-memory behavior. It only changes the address passed to the existing SwiftNIO server bootstrap.

Remaining limitations

• Tailscale must be running and its CLI must be available on PATH.

• Tailnet detection currently supports IPv4 only.

• Access control relies on the Tailnet ACL. The API still has no application-level authentication or TLS.

• The smoke test reached the server through the host Tailnet address. A request originating from a second Tailnet device has not yet been recorded.

• The complete serial test suite has not yet been run; validation so far used the focused server argument suite.

• The change does not load a complete checkpoint, shard, or large model tensor into Swift heap memory.

• Logs and artifacts contain no credentials, private paths, or model weights.

[jezonek]

Hello, great work! Could you add an option to bind to the selected ip address? Imho listening on 0.0.0.0 is secure enough within LAN.

[hmmhmmhm]

@jezonek I intentionally kept this PR Tailnet-specific because the server has no authentication or TLS.

Binding to 0.0.0.0 would expose it beyond the authenticated Tailnet boundary, so I’d prefer to keep this PR narrowly scoped. A configurable bind address could be discussed separately.