feat: add loopback host configuration for health checks

- Introduced LOOPBACK_HTTP_HOSTS in config.py to define valid loopback addresses for health-check URL and MINI_APP_SKIP_AUTH safety.
- Updated run.py to utilize LOOPBACK_HTTP_HOSTS for determining the host in health check and authentication logic.
- Enhanced test_app.py to skip tests if the required webapp output directory is not built, improving test reliability.

tests/test_app.py

@@ -1,6 +1,7 @@
 """Tests for FastAPI app /api/duties."""
 
 import time
+from pathlib import Path
 from unittest.mock import ANY, patch
 
 import pytest
@@ -59,7 +60,15 @@ def test_app_static_has_no_store_and_vary(client):
 
 def test_app_js_has_no_store(client):
     """JS and all static under /app get Cache-Control: no-store."""
-    r = client.get("/app/js/main.js")
+    webapp_out = config.PROJECT_ROOT / "webapp-next" / "out"
+    if not webapp_out.is_dir():
+        pytest.skip("webapp-next/out not built")
+    # Next.js static export serves JS under _next/static/chunks/<hash>.js
+    js_files = list(webapp_out.glob("_next/static/chunks/*.js"))
+    if not js_files:
+        pytest.skip("no JS chunks in webapp-next/out")
+    rel = js_files[0].relative_to(webapp_out)
+    r = client.get(f"/app/{rel.as_posix()}")
     assert r.status_code == 200
     assert r.headers.get("cache-control") == "no-store"