feat: add PLANNOTATOR_URL_HOST display-only override for advertised URLs

[backnotprop]

TLDR: adds PLANNOTATOR_URL_HOST (config key urlHost), a display-only host override for advertised session URLs, so remote-mode users on a tailnet or LAN get links another device can actually open instead of http://localhost:<port>. Closes #657.

Behavior

Remote mode (PLANNOTATOR_REMOTE=1) already binds 0.0.0.0, so the server is reachable over Tailscale. But every advertised URL hardcoded http://localhost:<port>, so a user on Pi via the Paseo mobile app got a localhost link their phone cannot open. This is the concrete ask in #657, and this PR implements exactly that: a host-only display override.

• PLANNOTATOR_URL_HOST env var takes precedence, then ~/.plannotator/config.json { "urlHost": "..." }, else localhost. Resolution lives in resolveUrlHost() in packages/shared/config.ts, following the existing resolveSharingEnabled pattern.
• Host only: bare hostnames (MagicDNS names), IPv4, and bracketed IPv6 ([fd7a::1]) are accepted. Anything with a scheme, /, @, ?, #, whitespace, or a : outside IPv6 brackets is rejected, because the port is chosen at runtime and always appended. Invalid values warn once on stderr and fall back to localhost; a display setting never crashes a server launch.
• buildAdvertisedUrl(port) composes the URL in packages/server/remote.ts (Bun) with a behaviorally identical mirror in apps/pi-extension/server/network.ts (Node). All 7 URL construction sites now use it: plan, review, annotate, and goal-setup servers on Bun; plan, review, and annotate on Pi.
• Remote-mode terminal copy adapts: with an override the message becomes "open on your device: " (Bun shared-handlers.ts, Pi index.ts), since port-forwarding advice is wrong for a directly reachable host. Without an override the existing copy is unchanged.
• Local (loopback-bound) sessions ignore the override entirely: localhost is advertised and opened, with a once-per-process stderr warning that PLANNOTATOR_REMOTE=1 is required. Honoring it locally would auto-open a URL nothing is listening on and leave the agent blocked on the review. Binding is never widened.
• The env var takes precedence over the config key, and an empty-but-set env var (PLANNOTATOR_URL_HOST=) suppresses a config-file urlHost.
• The invalid-host warning JSON-encodes the echoed value, so a newline embedded in the env var cannot forge extra stderr lines (hosts surface session-ready stderr lines as clickable links).

Security stance

Strictly display-only. The override never touches getServerHostname() or any listening behavior; only PLANNOTATOR_REMOTE governs binding. Spawned agent-review jobs run on the same machine, so their PLANNOTATOR_API_URL is now explicitly pinned to http://127.0.0.1:<port> in both runtimes, meaning a tailnet-only hostname cannot break local agent jobs.

Caveat

Sessions are served over plain http. The core review, annotate, and approve flows work fine that way from another device, but browser features requiring a secure context, notably creating short share links from the UI, need HTTPS in front (e.g. tailscale serve). Documented in the remote-mode guide.

Tests

• resolveUrlHost / isValidUrlHost: accept/reject table and env-over-config precedence in packages/shared/config.test.ts.
• buildAdvertisedUrl: host+port composition including bracketed IPv6, invalid-host fallback, and a bind-hostname non-interference check, in both packages/server/remote.test.ts and apps/pi-extension/server/network.test.ts.
• Local-session ignore, single-line warning, and empty-env suppression each have direct tests; the server/shared/pi suites also pass with a hostile override planted (PLANNOTATOR_URL_HOST=unreachable.invalid, 1489 pass / 0 fail).
• Full suite: 2960 pass, 269 skip, 0 fail (3229 tests across 270 files); bun run typecheck clean after vendor.sh regeneration.

Docs updated: CLAUDE.md env table, marketing environment-variables reference, configuration page, and a new "Direct-reach hosts (Tailscale, LAN)" section in the remote-and-devcontainers guide.