fix(a7-3/s1): fail closed on non-loopback peers; require plaintext opt-in before challenge

utils_fd_peer_is_local now returns true only when getpeername SUCCEEDS and the
peer address classifies as loopback. A non-socket descriptor (pipe/socketpair)
or any getpeername error is NOT local, so the daemon auth gate fails closed
instead of treating an untestable --stdio pipe as trusted (daemon auth modules
are --daemon-only and the stdio path never loads a daemon config).

server_module_gate now requires --allow-unauthenticated for the loopback
plaintext auth path: a plaintext loopback connection without the operator
opt-in is refused at the config gate BEFORE server_auth_handshake, so no SCRAM
challenge is sent. Remote peers still require verified TLS regardless of the
flag; the handler keeps its defense-in-depth checks.

Docs state the exact policy (verified TLS with matching --client-cn, or
operator-opted-in loopback plaintext), drop the SSH/stdio auth-transport claim
(they are daemon-only), and add the loopback trust-boundary relay caveat and
the CN-only (no SAN) residual. Adds a unit-test negative for pipe/socketpair
and an integration test where a relay observes no challenge when the flag is
absent.

src/shared/utils.h

@@ -68,7 +68,12 @@ bool append_resume_eligible(unsigned long long old_size, unsigned long long chec
 bool append_tail_length(unsigned long long old_size, unsigned long long check_size,
                         unsigned long long* tail_out);
 /* Loopback / local-transport classification for the daemon auth gate and the
-   client credential rule.  See utils.c for the exact accepted forms. */
+   client credential rule.  utils_sockaddr_is_loopback accepts 127.0.0.0/8,
+   IPv6 ::1 and IPv4-mapped ::ffff:127.x.x.x; utils_host_is_loopback additionally
+   accepts the literal "localhost".  utils_fd_peer_is_local is fail-closed: it is
+   true only when getpeername SUCCEEDS and reports a loopback peer -- a non-socket
+   descriptor (pipe/socketpair) or any getpeername error yields false.  See
+   utils.c for the exact accepted forms. */
 bool utils_sockaddr_is_loopback(const struct sockaddr* addr);
 bool utils_fd_peer_is_local(int fd);
 bool utils_host_is_loopback(const char* host);