Fix server safety, IPv6 serving, and keyboard roll entry

[brainx]

The static server now requires ROLL2SEED_EXPOSE=1 for every non-loopback HOST override, parses request paths independently of the bind address so IPv6 works, and handles asynchronous file-stream errors without terminating the process. IPv6 listening URLs are printed with brackets, and the README documents the host restrictions.

Numeric roll shortcuts now work while a safety checkbox retains focus. Text inputs and modal dialogs keep their existing shortcut guards.

Validation:

• npm run check: 50 tests passed and the production build passed.
• Added 20 server regressions covering default and explicit binding, exposure opt-in enforcement, IPv6 HTTP requests, request restrictions, response headers, and continued service after an injected asynchronous read failure. Exposure tests capture the binding decision without opening non-loopback sockets.
• Verified the built app in the browser: after checking all three safety boxes, pressing 1, 2, and 3 records three rolls while the last checkbox remains focused.

Compatibility: configurations that previously supplied a non-loopback HOST without ROLL2SEED_EXPOSE=1 now fail before listening. Network deployments still require a trusted TLS-terminating proxy. No dependency changes.