feat(security): warn when SMB_ADDRESS uses plaintext http to a remote host

[birme]

Summary

• At startup, src/server.ts now parses SMB_ADDRESS and, if the scheme is http: and the hostname is not localhost/127.0.0.1/::1, emits a Log().warn(...) explaining that SDP/ICE data would be sent unencrypted and to use https:// in production.
• Parsing is wrapped in a try/catch so a malformed SMB_ADDRESS logs a warning instead of crashing startup.
• Warning-only behavior: never a hard failure.

Test plan

• npm run typecheck clean
• npm test all pass (243 tests; the "worker process failed to exit gracefully" warning is a pre-existing timer-leak notice, not a failure)
• npm run lint clean for src/server.ts
• Manual: start with SMB_ADDRESS=http://remote-host:8080 and confirm the warning appears; confirm no warning for http://localhost:8080 or https://...

Closes #276