Add authentication for TCP host API listeners

Problem

The host API exposed by --listen and --services is unauthenticated, including when API token authentication is enabled for the gateway endpoint. These options accept TCP addresses, so configuring a listener such as tcp://0.0.0.0:8080 exposes the control API on all network interfaces without authentication.

Proposal

Apply Bearer token authentication to TCP host API listeners when an API token is configured. Unix socket listeners can continue relying on socket permissions. If authentication is intentionally out of scope for host listeners, document the risk and warn when a TCP listener is bound to a non-loopback address.

Related: #735, #724.