fix: harden application and management listeners

[cloudcarver]

Summary

• bind the main HTTP server to its configured host with IPv6-safe formatting
• make metrics disabled and loopback-bound by default with explicit configuration
• bind pprof to loopback by default
• add defensive HTTP timeouts and listener configuration tests
• explicitly expose the generated container application where container networking requires it

Validation

• go test ./...
• go test -race ./pkg/app ./pkg/metrics ./pkg/server
• go vet ./...
• make gen

Closes #39
Closes #47
Closes #52