Bind the development web server to localhost by default

config/Greynir.conf set host = 0.0.0.0, and the config file overrides the
GREYNIR_HOST environment variable (settings.py:183), so there was no way to
narrow the binding without editing this file. Running main.py on a host with
a public IP therefore exposed the Flask development server, with full access
to the production database, on every interface.

This only affects the development server: production serves through gunicorn,
which takes its bind address from config/gunicorn_config.py, and deploy.sh
does not copy config/Greynir.conf to deployments. Anyone who does want to
reach the dev server from another machine can either change this value locally
or forward a port over SSH.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: vthorsteinsson

config/Greynir.conf

@@ -26,7 +26,7 @@ debug = true
 # Web server settings
 
 # Web host address
-host = 0.0.0.0
+host = 127.0.0.1
 # Web host port is '5000' by default
 # port = 5000