[FEAT] Only force the SABnzbd bind address when it is unset or loopback

Start in root/etc/s6-overlay/s6-rc.d/svc-sabnzbd/run and inspect how it chooses FAMILY and passes --server. Read the host key from [misc] in /config/sabnzbd.ini, ensuring [servers] entries are not matched, and preserve configured non-loopback hosts while retaining the current override for empty or loopback values. Done means the selected host survives container restarts in the shared-network setup without changing the existing loopback protection.

Is this a new feature request?

• I have searched the existing issues

Wanted change

root/etc/s6-overlay/s6-rc.d/svc-sabnzbd/run always passes --server "$FAMILY" to SABnzbd, where FAMILY is :: or 0.0.0.0 depending on whether IPv6 is available. That flag overrides whatever host is saved in sabnzbd.ini, and SABnzbd writes the override straight back into the file, so any host set through the config page is gone again on the next container start.

I would like that forcing to be conditional. If the host already configured in sabnzbd.ini is unset or a loopback address (empty, 127.0.0.1, ::1, localhost), keep forcing it exactly as today. If it is anything else, a reachable address the user set on purpose, leave it alone.

Reason for change

This has come up before, most recently in #240, and I want to be upfront that I am not asking to reopen that. The answer there was clear: forcing the bind address exists so nobody accidentally sets it to 127.0.0.1 and locks themselves out of the web UI, and the suggested alternative is to control reachability through the port mapping or a reverse proxy on a user defined bridge network.

That answer is right for the case it is answering. It does not cover one setup though: running sabnzbd with network_mode: container:<other container>, sharing another container's network namespace, which is the usual way to put a download client behind a VPN container for a kill switch. In that mode there is no separate bridge network to put a reverse proxy on, and there is no port to map either, because the sabnzbd process's network stack is literally the other container's. The host it needs to bind to is whatever that other container exposes, which is a deliberate value rather than a mistake, and it is exactly the kind of value the current code cannot let survive a restart.

Restricting the override to the unset or loopback case does not touch the failure mode described in #240. A loopback bind cannot be reached from outside the container either way, so forcing it away from loopback keeps helping exactly as it does now. It only stops overriding a host that is already reachable, which by definition cannot be the lockout scenario.

Proposed code change

Read the host key from the [misc] section of /config/sabnzbd.ini before choosing $FAMILY, and only apply the forced value when that host is empty or loopback. Otherwise pass the configured host back through --server unchanged, which makes the flag a no-op for that case.

Section tracking matters when reading it, because the NNTP server entries under [servers] carry their own unindented host = ... line and matching the wrong one would hand a news server's hostname to --server.

I have the diff ready and will open a pull request against it if the direction seems reasonable.