Harden local runtime safety and error handling

cmd/qfs/config_migration_test.go

@@ -64,3 +64,28 @@ logging:
 		t.Fatalf("migrated config did not preserve logging level:\n%s", text)
 	}
 }
+
+func TestEnsureLoopbackServerHost(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		host    string
+		wantErr bool
+	}{
+		{host: "127.0.0.1", wantErr: false},
+		{host: "localhost", wantErr: false},
+		{host: "::1", wantErr: false},
+		{host: "0.0.0.0", wantErr: true},
+		{host: "192.168.1.10", wantErr: true},
+	}
+
+	for _, tc := range cases {
+		err := ensureLoopbackServerHost(tc.host)
+		if tc.wantErr && err == nil {
+			t.Fatalf("expected error for host %q", tc.host)
+		}
+		if !tc.wantErr && err != nil {
+			t.Fatalf("unexpected error for host %q: %v", tc.host, err)
+		}
+	}
+}