feat: add --host option to restrict listening interface

Add -H/--host option to specify which host/interface to listen on.
Useful for restricting access to localhost only for security.

Examples:
  --host 127.0.0.1  # IPv4 localhost only
  --host ::1        # IPv6 localhost only

PR: ericc-ch#157

Author: jacks0n

README.md

@@ -156,6 +156,7 @@ The following command line options are available for the `start` command:
 | Option         | Description                                                                   | Default    | Alias |
 | -------------- | ----------------------------------------------------------------------------- | ---------- | ----- |
 | --port         | Port to listen on                                                             | 4141       | -p    |
+| --host         | Host/interface to listen on (e.g., 127.0.0.1 for IPv4, ::1 for IPv6)          | all (::)   | -H    |
 | --verbose      | Enable verbose logging                                                        | false      | -v    |
 | --account-type | Account type to use (individual, business, enterprise)                        | individual | -a    |
 | --manual       | Enable manual request approval                                                | false      | none  |
@@ -166,6 +167,26 @@ The following command line options are available for the `start` command:
 | --show-token   | Show GitHub and Copilot tokens on fetch and refresh                           | false      | none  |
 | --proxy-env    | Initialize proxy from environment variables                                   | false      | none  |
 
+#### Usage examples with --host
+
+Listen on IPv4 localhost only:
+
+```sh
+npx copilot-api@latest start --account-type business --host 127.0.0.1
+```
+
+Listen on IPv6 localhost only:
+
+```sh
+npx copilot-api@latest start --account-type business --host ::1
+```
+
+Default (listen on all interfaces):
+
+```sh
+npx copilot-api@latest start --account-type business
+```
+
 ### Auth Command Options
 
 | Option       | Description               | Default | Alias |

src/start.ts

@@ -16,6 +16,7 @@ import { server } from "./server"
 
 interface RunServerOptions {
   port: number
+  host?: string
   verbose: boolean
   accountType: string
   manual: boolean
@@ -117,6 +118,7 @@ export async function runServer(options: RunServerOptions): Promise<void> {
   serve({
     fetch: server.fetch as ServerHandler,
     port: options.port,
+    hostname: options.host,
   })
 }
 
@@ -138,6 +140,12 @@ export const start = defineCommand({
       default: false,
       description: "Enable verbose logging",
     },
+    host: {
+      alias: "H",
+      type: "string",
+      description:
+        "Host/interface to listen on (e.g., 127.0.0.1 for IPv4 localhost, ::1 for IPv6 localhost)",
+    },
     "account-type": {
       alias: "a",
       type: "string",
@@ -193,6 +201,7 @@ export const start = defineCommand({
 
     return runServer({
       port: Number.parseInt(args.port, 10),
+      host: args.host,
       verbose: args.verbose,
       accountType: args["account-type"],
       manual: args.manual,