🔒 secure backend by binding uvicorn to localhost

🎯 What: Changed the uvicorn host binding from 0.0.0.0 to 127.0.0.1 in server/start.sh.
⚠️ Risk: Binding to 0.0.0.0 exposes the unauthenticated backend API to any network interface, potentially allowing unauthorized access.
🛡️ Solution: Binding to 127.0.0.1 ensures the FastAPI backend is only accessible from the local machine, relying on the Next.js frontend to securely proxy external requests.

Co-authored-by: LyAhn <27559362+LyAhn@users.noreply.github.com>

server/start.sh

@@ -72,7 +72,7 @@ fi
 #    Pass DEVICE env var so the server can select the correct torch device.
 # ---------------------------------------------------------------------------
 echo ""
-echo "--> Starting uvicorn on http://0.0.0.0:8000"
+echo "--> Starting uvicorn on http://127.0.0.1:8000"
 export PYTHONUTF8=1
 
 if $CPU_MODE; then
@@ -83,7 +83,7 @@ else
 fi
 
 exec uv run uvicorn vibevoice_server:app \
-    --host 0.0.0.0 \
+    --host 127.0.0.1 \
     --port 8000 \
     --log-level info \
     "${PASSTHROUGH_ARGS[@]+"${PASSTHROUGH_ARGS[@]}"}"