Accept both host and hostname in isLocalHost

The previous commit (77ed649, "Use hostname not host for
local-handle comparison") fixed Gemini's port-in-WEB_ORIGIN
concern but introduced a regression for non-split-domain
deployments.  Without HANDLE_HOST/WEB_ORIGIN set, getInstanceHost
falls back to requestUrl.host (including any non-default port),
so stored handles for a local dev instance at localhost:3000 are
written as @alice@localhost:3000.  Stripping the port out of
the comparison in isLocalHost then made those handles fail to
match: the comparison input is localhost:3000 (the stored host
segment) but the check value was localhost (the hostname).
Emoji reactions sent as myemoji@localhost:3000 got misclassified
as remote and returned 404 when no prior remote reaction existed.

Keep the .hostname check (which still addresses the port-in-
WEB_ORIGIN concern) and add the .host comparison back as a
second clause.  Both forms are accepted, so split-domain
deployments (where stored handles use HANDLE_HOST without a
port) and non-split-domain dev (where stored handles include
the port from request.host) both work.  The comment is rewritten
to spell out why both forms are checked.

#484 (comment)

Assisted-by: Claude Code:claude-opus-4-7

Author: dahlia

src/instance-host.ts

@@ -13,8 +13,11 @@ export function getInstanceHost(fallback: URL | string): string {
 
 export function isLocalHost(host: string, requestUrl: URL): boolean {
   const lower = host.toLowerCase();
-  // Compare against hostname (not host) so a non-default port on the
-  // request URL doesn't make a local handle look remote.
+  // Accept both request URL forms: .host (with port) covers
+  // non-split-domain deployments whose stored handles include the
+  // port (e.g. local dev at localhost:3000), and .hostname (no port)
+  // covers split-domain setups where HANDLE_HOST never carries one.
+  if (lower === requestUrl.host.toLowerCase()) return true;
   if (lower === requestUrl.hostname.toLowerCase()) return true;
   if (HANDLE_HOST != null && lower === HANDLE_HOST) return true;
   if (WEB_ORIGIN_HOST != null && lower === WEB_ORIGIN_HOST) return true;