task_showcase: default bind 0.0.0.0 contradicts the documented 127.0.0.1:5005

从 assets/task_showcase/app.py:248-260 和 assets/task_showcase/README.md 的 Run 部分开始。验证当前的默认 bind 和文档中记录的 URL，然后运行 python app.py，并确认默认值为 loopback，而 --host 0.0.0.0 仍然是一个显式选项；更新 README 以提及该选项。

assets/task_showcase/app.py defaults its Flask bind to 0.0.0.0 while the README next to it documents python app.py as serving http://127.0.0.1:5005. The app is a read-only, unauthenticated renderer over local run artifacts, so the default quietly puts those artifacts (task definitions, reports, screenshots) on the LAN instead of loopback.

Current code (main)

assets/task_showcase/app.py:248-260:

parser.add_argument("--host", default="0.0.0.0")
parser.add_argument("--port", type=int, default=5005)
...
app.run(host=args.host, port=args.port, debug=args.debug)

assets/task_showcase/README.md Run section:

pip install flask
python app.py            # serves http://127.0.0.1:5005

The two disagree: following the README's plain python app.py binds all interfaces. Anyone on the same network can read the served tasks/reports; there is no auth on any route (fine for loopback, surprising for 0.0.0.0). Windows Firewall will typically prompt on first run, but a prompt accepted once (or a Linux host with no host firewall) leaves it exposed.

Suggested fix

Default --host to 127.0.0.1, matching the README; keep --host 0.0.0.0 as the explicit opt-in for users who do want to share the dashboard on their network, and mention that flag in the README's Run section. One-line change plus a doc line.