70dd7a318e
Bound the dashboard and reuse probe to IPv4 loopback, removed wildcard CORS, and reported the actual listening hostname. Added regression coverage for non-loopback refusal and absent cross-origin access. Fixes #7633