feat(agent): harden API-first service

agent/cli.py

@@ -8,6 +8,7 @@
 from __future__ import annotations
 
 import argparse
+import ipaddress
 import json
 import sys
 
@@ -80,7 +81,23 @@ def _cmd_eval(args: argparse.Namespace, cfg: Config) -> int:
     return run_eval(cfg, args)
 
 
+def _is_loopback_bind(host: str) -> bool:
+    if host.casefold() == "localhost":
+        return True
+    try:
+        return ipaddress.ip_address(host).is_loopback
+    except ValueError:
+        return False
+
+
 def _cmd_serve(args: argparse.Namespace, cfg: Config) -> int:
+    if not _is_loopback_bind(args.host) and not cfg.api_key:
+        print(
+            "[Fehler] Nicht-lokaler API-Bind ohne PV_API_KEY abgelehnt. "
+            "Service-Key setzen oder nur an 127.0.0.1 binden.",
+            file=sys.stderr,
+        )
+        return 2
     import uvicorn
     uvicorn.run("agent.api:app", host=args.host, port=cfg.port, log_level="info")
     return 0