chore(scripts): embedding 服务改回只绑 127.0.0.1（0.0.0.0 实测无益且有暴露面）

主人 2026-10-07 最终口径：改回 127.0.0.1。

一个来回的结论登记进脚本注释，免得以后有人再试一遍：
- 0.0.0.0 是 IPv4 通配、不覆盖 IPv6（实测 netstat 只有
  TCP 0.0.0.0:11434 LISTENING，http://[::1]:11434 仍失败）
  ⇒ 它修不了「客户端把 localhost 解析成 ::1 而卡住」那个故障
- llama-server 没有鉴权 ⇒ 绑 0.0.0.0 等于向整个局域网暴露本机 embedding 算力
- EMBED_HOST 保留为可配置项（默认 127.0.0.1），将来真需要对外再打开

scripts/embed.bat

@@ -34,19 +34,17 @@ set "SYS=%SystemRoot%\System32"
 if not defined LLAMA_DIR set "LLAMA_DIR=%USERPROFILE%\apps\llama.cpp"
 if not defined EMBED_MODEL set "EMBED_MODEL=%USERPROFILE%\.models\Qwen3-Embedding-0.6B-Q8_0.gguf"
 if not defined EMBED_PORT set "EMBED_PORT=11434"
-rem EMBED_HOST: which interface llama-server binds to.
-rem Default 0.0.0.0 = the owner's call (2026-10-07). TWO FACTS, both measured
-rem on this machine -- know them before changing this value back and forth:
-rem   1) llama-server has NO auth. Binding 0.0.0.0 exposes this machine's
-rem      embedding compute to EVERY device on the LAN. Set EMBED_HOST=127.0.0.1
-rem      to keep it local-only again.
-rem   2) 0.0.0.0 is an IPv4 wildcard and does NOT cover IPv6 -- MEASURED on
-rem      this machine (2026-10-07): with --host 0.0.0.0, netstat shows only
-rem      "TCP 0.0.0.0:11434 LISTENING" (no IPv6 entry) and http://[::1]:11434
-rem      still fails. So a client that resolves "localhost" to ::1 still
-rem      cannot reach it; clients must dial 127.0.0.1 (see
-rem      internal/runtime/embedding). Binding 0.0.0.0 does NOT fix that.
-if not defined EMBED_HOST set "EMBED_HOST=0.0.0.0"
+rem EMBED_HOST: which interface llama-server binds to. Default 127.0.0.1
+rem (loopback only). History, so nobody repeats the experiment:
+rem   2026-10-07 the owner briefly asked for 0.0.0.0; it was measured and then
+rem   reverted, because (a) 0.0.0.0 is an IPv4 wildcard and does NOT cover
+rem   IPv6 -- with --host 0.0.0.0, netstat showed only "TCP 0.0.0.0:11434
+rem   LISTENING" (no IPv6 entry) and http://[::1]:11434 still failed, so it
+rem   did NOT fix the client-side hang it was meant to fix; and (b)
+rem   llama-server has NO auth, so 0.0.0.0 exposes this machine's embedding
+rem   compute to every device on the LAN.
+rem   Clients must dial 127.0.0.1 (see internal/runtime/embedding).
+if not defined EMBED_HOST set "EMBED_HOST=127.0.0.1"
 set "SERVER=%LLAMA_DIR%\llama-server.exe"
 set "LOG_FILE=%USERPROFILE%\llama.log"
 set "STDOUT_FILE=%USERPROFILE%\llama.stdout.log"