test(server): cover service endpoint plaintext security

[drew]

Summary

Add listener-level coverage for TLS gateways that allow loopback plaintext service HTTP. The tests exercise real TCP connections through the gateway listener to verify plaintext service endpoints stay loopback-only, reject cross-origin browser contexts, and do not expose the gRPC gateway surface.

Related Issue

None.

Changes

• Added gateway listener tests for non-loopback plaintext service HTTP rejection.
• Added CSRF-oriented service endpoint tests for Sec-Fetch-Site, Origin, and Referer rejection behavior.
• Added a regression test proving plaintext service HTTP does not allow successful gateway gRPC calls.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated

Additional targeted runs:

• cargo test -p openshell-server plaintext_service_http -- --nocapture
• cargo test -p openshell-server --lib
• cargo test -p openshell-server

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)