[P3] isLocalInstanceUrl doesn't recognize 0.0.0.0 / LAN hosts

[Bccorb]

Severity: P3 — Improvement

Where: src/core/config.ts:172-183 (isLocalInstanceUrl)

Problem
Only localhost, 127.0.0.1, ::1, [::1], *.localhost count as local, so a dev instance on 0.0.0.0:3000 or a LAN IP is rejected for --local (login.ts:31-36) and normalizeInstanceUrl forces https on it.

Suggested fix
Treat 0.0.0.0, private LAN ranges, and .local as local for dev delivery (or make it configurable).

Filed from an internal code audit (2026-07). File references are against main at audit time.