Reject non-loopback bind addresses for local engine starts

[mkalkere]

Description

engine:start / engine:install accepted any valid IP as the bind override, which put an unauthenticated engine API on 0.0.0.0. Remote starts already hard-bind 127.0.0.1; local starts now reject non-loopback binds with -32602 "bind must be a loopback address".

Scope

Included: services/nvpair-engine-manager bind validation, bind_validation_test.go, version bump, docs/engine-bind-validation.mdx. Nothing else touched.

Validation

• go test -race ./... in services/nvpair-engine-manager: pass (full suite ~49s).
• New tests: 0.0.0.0, 192.168.1.5, :: rejected; invalid IPs still rejected as invalid; loopback passes.
• Toolchain: Go 1.26.8 (repo requires Go 1.25+), Linux sandbox. go vet clean, gofmt clean, node scripts/spdx-headers.mjs reports 0 missing headers on every branch.

Risk

• Anyone deliberately binding a local engine to a LAN address now gets an error. That was never a supported configuration (the remote path hard-binds loopback), so this closes an accidental exposure, not a feature.
• Version note: open PR fix: resolve 14 review issues across the service control plane #14 bumps this component to 0.17.6; if it merges first this needs a rebase to reconcile.

Checklist

• I have read the Contributing Guidelines.
• Every commit is signed off (git commit -s), certifying the Developer Certificate of Origin.
• New or existing tests cover the change.
• Relevant documentation is updated.
• I checked the diff, changed filenames, and commit messages for credentials, private data, internal URLs, internal issue identifiers, and generated artifacts.
• I recorded the validation commands and results above.
• I bumped any affected component in services/versions.json, and described user-visible changes above so they reach the release notes.