feat: add loopback host configuration for health checks

- Introduced LOOPBACK_HTTP_HOSTS in config.py to define valid loopback addresses for health-check URL and MINI_APP_SKIP_AUTH safety.
- Updated run.py to utilize LOOPBACK_HTTP_HOSTS for determining the host in health check and authentication logic.
- Enhanced test_app.py to skip tests if the required webapp output directory is not built, improving test reliability.

duty_teller/config.py

@@ -22,6 +22,9 @@ logger = logging.getLogger(__name__)
 # Valid port range for HTTP_PORT.
 HTTP_PORT_MIN, HTTP_PORT_MAX = 1, 65535
 
+# Host values treated as loopback (for health-check URL and MINI_APP_SKIP_AUTH safety).
+LOOPBACK_HTTP_HOSTS = ("127.0.0.1", "localhost", "::1", "")
+
 # Project root (parent of duty_teller package). Used for webapp path, etc.
 PROJECT_ROOT = Path(__file__).resolve().parent.parent
 

duty_teller/run.py

@@ -77,7 +77,7 @@ def _run_uvicorn(web_app, port: int) -> None:
 def _wait_for_http_ready(port: int) -> bool:
     """Return True if /health responds successfully within _HTTP_STARTUP_WAIT_SEC."""
     host = config.HTTP_HOST
-    if host == "0.0.0.0":
+    if host not in config.LOOPBACK_HTTP_HOSTS:
         host = "127.0.0.1"
     url = f"http://{host}:{port}/health"
     deadline = time.monotonic() + _HTTP_STARTUP_WAIT_SEC
@@ -113,7 +113,7 @@ def main() -> None:
         logger.warning(
             "MINI_APP_SKIP_AUTH is set — API auth disabled (insecure); use only for dev"
         )
-        if config.HTTP_HOST not in ("127.0.0.1", "localhost", ""):
+        if config.HTTP_HOST not in config.LOOPBACK_HTTP_HOSTS:
             print(
                 "ERROR: MINI_APP_SKIP_AUTH must not be used in production (non-localhost).",
                 file=sys.stderr,