fix(verisim-api): bracket IPv6 hosts in socket addresses

The HTTP/gRPC/TLS servers each did `format!("{}:{}", host, port)` to build
a socket address string, which produces invalid output when host is an
IPv6 literal without brackets. With VERISIM_HOST=:: and VERISIM_GRPC_PORT=50051
the gRPC server emitted "::50051" and SocketAddr::parse rejected it with
"invalid socket address syntax", crashing the process.

This is a real problem on fly.io where apps default to ::-binding to
register with the 6PN network.

Fix: add fmt_socket_addr(host, port) helper that wraps the host in
brackets per RFC 3986 §3.2.2 when it contains ':' and isn't already
bracketed. Use it for all three bind sites (HTTP, gRPC, TLS).

Tests: 4 new unit tests covering IPv4 passthrough, IPv6 bracket-insertion,
pre-bracketed passthrough, and a SocketAddr::parse roundtrip against
"::", "::1", "0.0.0.0", "127.0.0.1".

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

rust-core/verisim-api/src/lib.rs

@@ -213,6 +213,18 @@ fn validate_limit(limit: usize) -> usize {
     limit.min(MAX_RESULT_LIMIT)
 }
 
+/// Format a host+port into a socket address string that `SocketAddr::parse`
+/// accepts. IPv6 hosts (containing `:` and not already bracketed) are
+/// wrapped in brackets per RFC 3986 §3.2.2, so that `"::"` + `8080`
+/// becomes `"[::]:8080"` rather than the ambiguous `"::8080"`.
+fn fmt_socket_addr(host: &str, port: u16) -> String {
+    if host.contains(':') && !host.starts_with('[') {
+        format!("[{host}]:{port}")
+    } else {
+        format!("{host}:{port}")
+    }
+}
+
 /// Validate a octad ID: max 128 chars, alphanumeric + dash + underscore only.
 fn validate_octad_id(id: &str) -> Result<(), ApiError> {
     if id.is_empty() {
@@ -2043,15 +2055,15 @@ pub async fn serve(config: ApiConfig) -> Result<(), std::io::Error> {
         .layer(axum::extract::DefaultBodyLimit::max(config.max_body_size));
 
     // Start HTTP server
-    let http_addr = format!("{}:{}", config.host, config.port);
+    let http_addr = fmt_socket_addr(&config.host, config.port);
     info!(addr = %http_addr, "Starting VeriSimDB HTTP server");
     let listener = TcpListener::bind(&http_addr).await?;
 
     let http_server = axum::serve(listener, app).with_graceful_shutdown(shutdown_signal());
 
     // Start gRPC server (if enabled)
     if config.grpc_port > 0 {
-        let grpc_addr = format!("{}:{}", config.host, config.grpc_port);
+        let grpc_addr = fmt_socket_addr(&config.host, config.grpc_port);
         info!(addr = %grpc_addr, "Starting VeriSimDB gRPC server");
 
         let grpc_router = grpc::build_grpc_router(state);
@@ -2126,7 +2138,7 @@ pub async fn serve_tls(
     let octad_store = state.octad_store.clone();
     let app = build_router(state);
 
-    let addr = format!("{}:{}", config.host, config.port);
+    let addr = fmt_socket_addr(&config.host, config.port);
     info!(addr = %addr, cert = %cert_path, "Starting VeriSimDB API server with TLS");
 
     let tls_config = RustlsConfig::from_pem_file(cert_path, key_path)
@@ -2638,6 +2650,36 @@ mod tests {
     // Additional unit tests — API endpoints and validation
     // -----------------------------------------------------------------------
 
+    #[test]
+    fn test_fmt_socket_addr_ipv4() {
+        assert_eq!(fmt_socket_addr("0.0.0.0", 8080), "0.0.0.0:8080");
+        assert_eq!(fmt_socket_addr("127.0.0.1", 80), "127.0.0.1:80");
+    }
+
+    #[test]
+    fn test_fmt_socket_addr_ipv6_unbracketed_gets_brackets() {
+        assert_eq!(fmt_socket_addr("::", 8080), "[::]:8080");
+        assert_eq!(fmt_socket_addr("::1", 22), "[::1]:22");
+        assert_eq!(fmt_socket_addr("2001:db8::1", 443), "[2001:db8::1]:443");
+    }
+
+    #[test]
+    fn test_fmt_socket_addr_ipv6_prebracketed_passes_through() {
+        assert_eq!(fmt_socket_addr("[::]", 8080), "[::]:8080");
+        assert_eq!(fmt_socket_addr("[::1]", 22), "[::1]:22");
+    }
+
+    #[test]
+    fn test_fmt_socket_addr_parses_roundtrip() {
+        use std::net::SocketAddr;
+        let cases = [("::", 8080u16), ("::1", 22u16), ("0.0.0.0", 80u16), ("127.0.0.1", 3000u16)];
+        for (host, port) in cases {
+            let s = fmt_socket_addr(host, port);
+            let parsed: SocketAddr = s.parse().unwrap_or_else(|e| panic!("parse {s}: {e}"));
+            assert_eq!(parsed.port(), port, "port mismatch for host={host}");
+        }
+    }
+
     #[test]
     fn test_validate_limit_caps_at_max() {
         assert_eq!(validate_limit(5000), MAX_RESULT_LIMIT);