Document the scope of isLocalHost

Add a short block comment above isLocalHost spelling out what
the function does and does not do: it's a string-equality check
between hostnames, with no DNS resolution and no authority over
the request itself.  This mirrors the AGENTS.md convention of
documenting the limits of security-adjacent checks so a future
reader doesn't mistake it for a gatekeeper.

No behavior change.

#484 (comment)

Assisted-by: Claude Code:claude-opus-4-7

Author: dahlia

src/instance-host.ts

@@ -11,6 +11,9 @@ export function getInstanceHost(fallback: URL | string): string {
   return typeof fallback === "string" ? fallback : fallback.host;
 }
 
+// String-equality check between hostnames; no DNS resolution and no
+// authority over the request itself.  Used by lookup paths to decide
+// whether a handle's host segment refers to this instance.
 export function isLocalHost(host: string, requestUrl: URL): boolean {
   const lower = host.toLowerCase();
   // Accept both request URL forms: .host (with port) covers