[Re-bin]

Summary

• show a browser-usable local health URL and explicitly warn when the listener binds beyond loopback
• bound health-server connection concurrency, shorten slow-client reads, and close responses explicitly
• publish the official Docker health port on host loopback by default and document remote-monitoring precautions

Security assessment

The gateway health listener already defaults to 127.0.0.1. Existing users may still have 0.0.0.0 in older or manually edited configs, and container deployments intentionally bind all interfaces inside the container. The endpoint returns only {"status": "ok"} and cannot invoke the agent, but an exposed listener still adds connection, bandwidth, and slow-client denial-of-service surface.

This keeps explicit non-loopback deployments backward compatible while making the exposure visible and limiting application-level resource use.

Validation

• PYTHONPATH="$PWD" pytest tests/cli/test_commands.py -q (117 passed)
• PYTHONPATH="$PWD" ruff check nanobot/cli/commands.py tests/cli/test_commands.py
• git diff --check
• docker compose config