feat(run): add --listen-addr so a local app can be reached from the network

[ako]

run --local binds the app to 127.0.0.1 and there is no way to widen it:
LocalRuntimeOptions.ListenAddr is the only field that reaches the runtime's
runtime_listen_addresses, and nothing sets it but the default at
applyDefaults. So the app cannot be opened from another machine on the LAN —
the use case being a phone or a second laptop pointing at a dev box, which is
not exotic enough to leave unsupported.

It cannot be fixed after boot either. appContainerParams is sent once, at
startup (StartLocalRuntime); re-sending update_appcontainer_configuration on a
running app fails, because the runtime already holds 127.0.0.1: and
Linux rejects a second bind of the same port on 0.0.0.0:

Runtime port '8095' is already in use
No permission to open socket or another server is already running on
Some(0.0.0.0):8095

So the address has to be right at startup, which means a flag.

The M2EE admin API is a privileged surface — it boots the app, rewrites
configuration and runs actions — so it must not be widened onto the network as
a side effect of widening the app bind. m2eeAdminListenAddr is a constant at
127.0.0.1, used for both the runtime's M2EE_ADMIN_LISTEN_ADDRESSES and mxcli's
own admin client. The client part is not tidiness: 0.0.0.0 is a bind address,
not a destination, so a client dialling it is not portable, and when the admin
bind was simply mirrored the readiness poll timed out with "runtime admin API
did not come up" on a runtime that was up and serving.

The default is unchanged at 127.0.0.1, so nothing behaves differently unless
asked.

Note for callers: the runtime derives ApplicationRootUrl from the bind address
when none is set, and 0.0.0.0 is not a host a browser can ask for. Pair this
with a reachable root URL — an ApplicationRootUrl naming a real host in the
model, or --runtime-setting ApplicationRootUrl=http://:/. The flag
help says so.

Closes #1248