Document the local router for open source and warn when it is not bound to loopback.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/laya_router/cli.py

@@ -81,6 +81,12 @@ def cmd_serve(_: argparse.Namespace) -> int:
 
     print(f"laya-router {__version__} on {settings.base_url}", flush=True)
     print(f"看板 {settings.base_url}/", flush=True)
+    if settings.host not in {"127.0.0.1", "localhost", "::1"}:
+        print(
+            f"警告: 服务绑定在 {settings.host}，没有鉴权。看板和 /route 会暴露 prompt。请改回 127.0.0.1。",
+            file=sys.stderr,
+            flush=True,
+        )
     uvicorn.run(
         "laya_router.server:app",
         host=settings.host,