Function is_loopback_bind 

pub fn is_loopback_bind(bind: &str) -> bool

True when bind is a loopback/desktop address, for which the per-IP DoS rate limiter (build_rate_limiter, #13) is intentionally SKIPPED. The desktop sidecar serves the local frontend, which legitimately bursts ~45 hashed /assets/* requests on load and would otherwise trip the 429 limit (burst default 20). Mirrors the loopback special-casing already used for CORS; network binds (0.0.0.0) are still throttled.